show owner avatar in repo row

Reviewed-on: #33

.github/workflows/release.yml

@@ -0,0 +1,173 @@
+name: Build and Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: windows-x64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+          - platform: windows-arm64
+            os: windows-11-arm
+            target: aarch64-pc-windows-msvc
+          - platform: macos-x64
+            os: macos-15-intel
+            target: x86_64-apple-darwin
+          - platform: macos-arm64
+            os: macos-latest
+            target: aarch64-apple-darwin
+          - platform: linux-x64
+            os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - platform: linux-arm64
+            os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      # Windows and macOS builds using cargo-packager
+      - name: Build with cargo-packager (Windows/macOS)
+        if: runner.os != 'Linux'
+        working-directory: desktop
+        run: |
+          cargo install cargo-packager --locked
+          cargo packager --release
+
+      - name: Upload Windows/macOS artifacts
+        if: runner.os != 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.platform }}-artifacts
+          path: |
+            dist/*.dmg
+            dist/*.msi
+            dist/*.exe
+          if-no-files-found: error
+
+      # Linux builds using custom scripts
+      - name: Install Linux build dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y flatpak flatpak-builder snapd squashfs-tools jq gettext-base
+
+      - name: Install Snapcraft
+        if: runner.os == 'Linux'
+        run: sudo snap install snapcraft --classic
+
+      - name: Make scripts executable
+        if: runner.os == 'Linux'
+        run: |
+          chmod +x script/get-crate-version
+          chmod +x script/linux
+          chmod +x script/bundle-snap
+          chmod +x script/bundle-linux
+          chmod +x script/flatpak/deps
+          chmod +x script/flatpak/bundle-flatpak
+
+      - name: Install required dependencies
+        if: runner.os == 'Linux'
+        run: ./script/linux
+
+      # Build the release tarball on every Linux architecture
+      - name: Build release tarball
+        if: runner.os == 'Linux'
+        run: ./script/bundle-linux
+
+      # Only build Flatpak and Snap for x86_64 (most common use case)
+      - name: Build Flatpak
+        if: runner.os == 'Linux' && matrix.target == 'x86_64-unknown-linux-gnu'
+        run: |
+          ./script/flatpak/deps
+          ./script/flatpak/bundle-flatpak
+
+      - name: Build Snap
+        if: runner.os == 'Linux' && matrix.target == 'x86_64-unknown-linux-gnu'
+        run: |
+          VERSION=$(script/get-crate-version signed)
+          ./script/bundle-snap $VERSION
+
+      - name: Collect Linux artifacts
+        if: runner.os == 'Linux'
+        working-directory: ${{ github.workspace }}
+        run: |
+          mkdir -p linux-artifacts
+          # Copy the tarball created by bundle-linux
+          find target/release -name "*.tar.gz" -exec cp {} linux-artifacts/ \;
+          # Find and copy flatpak files (if they exist)
+          find . -name "*.flatpak" -exec cp {} linux-artifacts/ \; || true
+          # Find and copy snap files (if they exist)
+          find . -name "*.snap" -exec cp {} linux-artifacts/ \; || true
+          ls -la linux-artifacts/
+
+      - name: Upload Linux artifacts
+        if: runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.platform }}-artifacts
+          path: linux-artifacts/**/*
+          if-no-files-found: error
+
+  release:
+    name: Create Release
+    needs: build
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Make get-crate-version executable
+        run: chmod +x script/get-crate-version
+
+      - name: Get version
+        id: version
+        run: |
+          VERSION=$(script/get-crate-version signed)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "tag=v$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Display artifacts structure
+        run: |
+          echo "Artifacts structure:"
+          find artifacts -type f -exec ls -la {} \;
+
+      - name: Create draft release
+        id: create_release
+        uses: akkuman/gitea-release-action@v1
+        with:
+          server_url: "https://git.reya.info/"
+          repository: "reya/signed"
+          token: ${{ secrets.GITEA_TOKEN }}
+          draft: true
+          prerelease: false
+          files: |
+            artifacts/**/*
+
+      - name: Output release info
+        run: |
+          echo "Created draft release: ${{ steps.create_release.outputs.url }}"
+          echo "Release ID: ${{ steps.create_release.outputs.id }}"

.github/workflows/rust.yml

@@ -0,0 +1,32 @@
+name: Rust
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["m**"]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        rustup: [stable]
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Linux build dependencies
+        run: chmod +x ./script/linux && ./script/linux
+        if: matrix.os == 'ubuntu-latest'
+
+      - name: Build
+        run: cargo build --verbose
+
+      - name: Run tests
+        run: cargo test --verbose

.gitignore

@@ -1 +1,20 @@
-/target
+# Generated by Cargo
+# will have compiled files and executables
+debug/
+target/
+dist/
+
+# Snap and Flatpak local build output
+/snap
+/info.reya.signed.json
+/linux-artifacts
+
+# Vendored dependencies + cargo config generated by script/prepare-flathub
+.cargo/
+vendor/
+
+# MSVC Windows builds of rustc generate these, which store debugging information
+*.pdb
+
+# macOS
+.DS_Store

AGENTS.md

@@ -0,0 +1,162 @@
+# Rust coding guidelines
+
+* Prioritize code correctness and clarity. Speed and efficiency are secondary priorities unless otherwise specified.
+* Do not write organizational or comments that summarize the code. Comments should only be written in order to explain "why" the code is written in some way in the case there is a reason that is tricky / non-obvious.
+* Keep doc comments and comments simple, one line, straightforward, and unbloated.
+* Prefer implementing functionality in existing files unless it is a new logical component. Avoid creating many small files.
+* Prefer `impl` blocks over standalone functions: place functionality as methods or associated functions on the relevant type, extending the type's existing `impl` block instead of creating a duplicate one in another file.
+* Do not wrap clients or SDK dependencies in project structs or pass-through helper functions, call their methods directly where needed. Extract a helper only when it holds real logic that is used in more than one place.
+* Bind a global store handle to a local before using it (`let state = GlobalState::global(cx);` then `state.update(...)`) instead of chaining on `CheckoutsStore::global(cx)` inline.
+* Avoid using functions that panic like `unwrap()`, instead use mechanisms like `?` to propagate errors.
+* Be careful with operations like indexing which may panic if the indexes are out of bounds.
+* Never silently discard errors with `let _ =` on fallible operations. Always handle errors appropriately:
+  - Propagate errors with `?` when the calling function should handle them
+  - Use `.log_err()` or similar when you need to ignore errors but want visibility
+  - Use explicit error handling with `match` or `if let Err(...)` when you need custom logic
+  - Example: avoid `let _ = client.request(...).await?;` - use `client.request(...).await?;` instead
+* When implementing async operations that may fail, ensure errors propagate to the UI layer so users get meaningful feedback.
+* Avoid creative additions unless explicitly requested
+* Use full words for variable names (no abbreviations like "q" for "queue")
+* Use variable shadowing to scope clones in async contexts for clarity, minimizing the lifetime of borrowed references.
+  Example:
+  ```rust
+  executor.spawn({
+      let task_ran = task_ran.clone();
+      async move {
+          *task_ran.borrow_mut() = true;
+      }
+  });
+  ```
+
+# Timers in tests
+
+* In GPUI tests, prefer GPUI executor timers over `smol::Timer::after(...)` when you need timeouts, delays, or to drive `run_until_parked()`:
+  - Use `cx.background_executor().timer(duration).await` (or `cx.background_executor.timer(duration).await` in `TestAppContext`) so the work is scheduled on GPUI's dispatcher.
+  - Avoid `smol::Timer::after(...)` for test timeouts when you rely on `run_until_parked()`, because it may not be tracked by GPUI's scheduler and can lead to "nothing left to run" when pumping.
+
+# GPUI
+
+GPUI is a UI framework which also provides primitives for state and concurrency management.
+
+## Context
+
+Context types allow interaction with global state, windows, entities, and system services. They are typically passed to functions as the argument named `cx`. When a function takes callbacks they come after the `cx` parameter.
+
+* `App` is the root context type, providing access to global state and read and update of entities.
+* `Context<T>` is provided when updating an `Entity<T>`. This context dereferences into `App`, so functions which take `&App` can also take `&Context<T>`.
+* `AsyncApp` and `AsyncWindowContext` are provided by `cx.spawn` and `cx.spawn_in`. These can be held across await points.
+
+## `Window`
+
+`Window` provides access to the state of an application window. It is passed to functions as an argument named `window` and comes before `cx` when present. It is used for managing focus, dispatching actions, directly drawing, getting user input state, etc.
+
+## Entities
+
+An `Entity<T>` is a handle to state of type `T`. With `thing: Entity<T>`:
+
+* `thing.entity_id()` returns `EntityId`
+* `thing.downgrade()` returns `WeakEntity<T>`
+* `thing.read(cx: &App)` returns `&T`.
+* `thing.read_with(cx, |thing: &T, cx: &App| ...)` returns the closure's return value.
+* `thing.update(cx, |thing: &mut T, cx: &mut Context<T>| ...)` allows the closure to mutate the state, and provides a `Context<T>` for interacting with the entity. It returns the closure's return value.
+* `thing.update_in(cx, |thing: &mut T, window: &mut Window, cx: &mut Context<T>| ...)` takes a `AsyncWindowContext` or `VisualTestContext`. It's the same as `update` while also providing the `Window`.
+
+Within the closures, the inner `cx` provided to the closure must be used instead of the outer `cx` to avoid issues with multiple borrows.
+
+Trying to update an entity while it's already being updated must be avoided as this will cause a panic.
+
+`WeakEntity<T>` is a weak handle. It has `read_with`, `update`, and `update_in` methods that work the same, but always return an `anyhow::Result` so that they can fail if the entity no longer exists. This can be useful to avoid memory leaks - if entities have mutually recursive handles to each other they will never be dropped.
+
+## Concurrency
+
+All use of entities and UI rendering occurs on a single foreground thread.
+
+`cx.spawn(async move |cx| ...)` runs an async closure on the foreground thread. Within the closure, `cx` is `&mut AsyncApp`.
+
+When the outer cx is a `Context<T>`, the use of `spawn` instead looks like `cx.spawn(async move |this, cx| ...)`, where `this: WeakEntity<T>` and `cx: &mut AsyncApp`.
+
+To do work on other threads, `cx.background_spawn(async move { ... })` is used. Often this background task is awaited on by a foreground task which uses the results to update state.
+
+Both `cx.spawn` and `cx.background_spawn` return a `Task<R>`, which is a future that can be awaited upon. If this task is dropped, then its work is cancelled. To prevent this one of the following must be done:
+
+* Awaiting the task in some other async context.
+* Detaching the task via `task.detach()` or `task.detach_and_log_err(cx)`, allowing it to run indefinitely.
+* Storing the task in a field, if the work should be halted when the struct is dropped.
+
+A task which doesn't do anything but provide a value can be created with `Task::ready(value)`.
+
+Prefer keeping a task in a field over `.detach()` when the work belongs to a view or store. A detached task outlives the view that started it (for example, a repository panel the user has closed), while a task stored in a field is cancelled when that struct drops. A finished `Task` held in a container is not reaped by GPUI - it stays alive until its handle is dropped - so if the container can accumulate many runs, either drop the finished handles before pushing a new one, or hold a single `Option<Task<_>>` and replace it.
+
+## Elements
+
+The `Render` trait is used to render some state into an element tree that is laid out using flexbox layout. An `Entity<T>` where `T` implements `Render` is sometimes called a "view".
+
+Example:
+
+```
+struct TextWithBorder(SharedString);
+
+impl Render for TextWithBorder {
+    fn render(&mut self, _window: &mut Window, _cx: &mut Context<Self>) -> impl IntoElement {
+        div().border_1().child(self.0.clone())
+    }
+}
+```
+
+Since `impl IntoElement for SharedString` exists, it can be used as an argument to `child`. `SharedString` is used to avoid copying strings, and is either an `&'static str` or `Arc<str>`.
+
+UI components that are constructed just to be turned into elements can instead implement the `RenderOnce` trait, which is similar to `Render`, but its `render` method takes ownership of `self` and receives `&mut App` instead of `&mut Context<Self>`. Types that implement this trait can use `#[derive(IntoElement)]` to use them directly as children.
+
+The style methods on elements are similar to those used by Tailwind CSS.
+
+If some attributes or children of an element tree are conditional, `.when(condition, |this| ...)` can be used to run the closure only when `condition` is true. Similarly, `.when_some(option, |this, value| ...)` runs the closure when the `Option` has a value.
+
+## Input events
+
+Input event handlers can be registered on an element via methods like `.on_click(|event, window, cx: &mut App| ...)`.
+
+Often event handlers will want to update the entity that's in the current `Context<T>`. The `cx.listener` method provides this - its use looks like `.on_click(cx.listener(|this: &mut T, event, window, cx: &mut Context<T>| ...)`.
+
+## Actions
+
+Actions are dispatched via user keyboard interaction or in code via `window.dispatch_action(SomeAction.boxed_clone(), cx)` or `focus_handle.dispatch_action(&SomeAction, window, cx)`.
+
+Actions with no data are defined with the `actions!(some_namespace, [SomeAction, AnotherAction])` macro call. Otherwise the `Action` derive macro is used. Doc comments on actions are displayed to the user.
+
+Action handlers can be registered on an element via the event handler `.on_action(|action, window, cx| ...)`. Like other event handlers, this is often used with `cx.listener`.
+
+## Notify
+
+When a view's state has changed in a way that may affect its rendering, it should call `cx.notify()`. This will cause the view to be rerendered. It will also cause any observe callbacks registered for the entity with `cx.observe` to be called.
+
+GPUI also tracks the entities a window reads while rendering. When an entity notifies, every view that read that entity during the previous frame is rerendered automatically.
+
+* A view that reads an entity in render (e.g. `state.read(cx).profile(...)`) does not need `cx.observe(&entity, ...)` to pick up its changes - the read itself is the dependency. Reserve `cx.observe` and `cx.subscribe` for when the view must run logic in response to a change (rebuild derived state, re-query, dedupe), not to trigger a re-render.
+* Notify the narrowest entity holding the change. Notifying a global store rerenders every view that ever read it; notifying a per-panel entity rerenders only the panels reading it.
+* This works with cached panels (`panel.cached(...)`): a cached subtree repaints when the view it belongs to is invalidated.
+
+## Entity events
+
+While updating an entity (`cx: Context<T>`), it can emit an event using `cx.emit(event)`. Entities register which events they can emit by declaring `impl EventEmitter<EventType> for EntityType {}`.
+
+Other entities can then register a callback to handle these events by doing `cx.subscribe(other_entity, |this, other_entity, event, cx| ...)`. This will return a `Subscription` which deregisters the callback when dropped.  Typically `cx.subscribe` happens when creating a new entity and the subscriptions are stored in a `_subscriptions: Vec<Subscription>` field.
+
+# Pull request hygiene
+
+When an agent opens or updates a pull request, it must:
+
+- Use a clear, correctly capitalized, imperative PR title (for example, `fix crash in project panel`).
+- Avoid conventional commit prefixes in PR titles (`fix:`, `feat:`, `docs:`, etc.).
+- Avoid trailing punctuation in PR titles.
+- Optionally prefix the title with a crate name when one crate is the clear scope (for example, `workspace: add history view`).
+- Include a `Release Notes:` section as the final section in the PR body.
+- Use one bullet under `Release Notes:`:
+  - `- Added ...`, `- Fixed ...`, or `- Improved ...` for user-facing changes, or
+  - `- N/A` for docs-only and other non-user-facing changes.
+- Format release notes exactly with a blank line after the heading, for example:
+
+```
+Release Notes:
+
+- N/A
+```

CHANGELOG.md

@@ -0,0 +1,90 @@
+# Changelog
+
+## v0.2.0 - 2026/10/21
+
+### Added
+
+- Follow the operating system's native theme on macOS, Windows and Linux (KDE, GNOME), applying the OS colors, fonts, radii and accessibility preferences.
+- Add an identity import dialog, importing an existing identity by pasting its `nsec` secret key (encrypted with a new passphrase), NIP-49 `ncryptsec` (unlocked with its passphrase), or `bunker://` NIP-46 URI
+- Add a dropdown menu on the signed-in user button in the sidebar
+- Add sign-out feature, confirmed by an alert dialog before deleting the stored session credential
+- Add a quit action, bound to `secondary-q` (cmd on macOS, ctrl on others)
+- Allow choosing the default branch when publishing a repository
+- Detect when local commits are not on Nostr yet, showing an unsynced count badge on sidebar repository rows and a Sync now banner on the repository view
+- Add a step-by-step push checklist while publishing and syncing a repository
+- Add a `Reset remote to local` action that republishes the mirror and deletes grasp refs the mirror does not have
+
+### Changed
+
+- Use the built-in light/dark syntax highlighting palette instead of the Signed palette bundled in `signed.json` when the native theme is active
+- Increase the default theme corner radii from 2 to 4 and large radii from 6 to 8
+- Surface backend errors as error notifications in the workspace instead of silently dropping them
+- Break ties in repository activity lists by event id, so same-second events order deterministically
+- Restructure the backend around domain types: git operations behind a `Repo` type, the grasp push pipeline behind `GraspPush`, nostr connectivity behind `NostrBackend`, and shared helpers consolidated into `utils`
+- Fetch the logged-in user's grasp list, code follows, followed repositories, contacts, profile metadata, mute list, and blossom servers via gossip at login instead of the bootstrap relays
+- Connect to grasp relays and load the inbox only after the user's grasp list event arrives
+- Refresh the checkouts store only when the checkouts settings change
+- Restructure the core crate into focused modules for announcements, pull requests, git events, inbox, and upstream state
+- Publish nostr events directly through the client with relay acceptance required, removing the grasp push helper and its per-server retry loop so failures surface immediately
+- Poll the repository sync drift check every 180 seconds instead of 60
+- Track sync status per view instead of globally
+- Merge the `PixelAvatar` into the `Avatar` component. Seed user pixel avatars from the public key instead of the display name, so avatars stay stable when a user renames
+
+### Fixed
+
+- Fix the repository view refreshing its mirror from the network while a push is in progress, so the refresh no longer races the push
+- Fix opening a repository failing with a `destination already exists` error when two loads raced to clone its mirror, clones are now serialized and later loads reuse the finished clone
+- Fix a repository never opening again after an interrupted clone left an unusable mirror directory behind, which is now removed and re-cloned
+- Fix signing in with a `bunker://` URI silently generating a new identity instead of erroring when its master key cannot be parsed
+- Fix repository sync failing with `state event in purgatory ... doesn't match push` when grasp servers hold branches or tags the local repository lacks
+- Fix sync failing with `could not fetch refs/tags/...^{}` on repositories with annotated tags, where the peel entries `git ls-remote` reports for annotated tags were mistaken for missing refs
+
+### Removed
+
+- Remove the light/dark theme pickers and the font size, corner radius, focus ring and shadow settings from the settings dialog; colors and geometry now come from the native theme
+- Remove dead code: the unused `login`/`logout` family, the unwired `SyncProgress` pipeline, `merge_pull_request`, inbox mark-read/archive APIs and the wasm32-only code paths
+
+## v0.2.0-alpha - 2026/09/27
+
+### Added
+
+- Show an avatar in each panel's tab, using the repository owner's profile picture when set and a pixel avatar otherwise
+- Add a Tab Bar setting to hide the previous/next tab buttons, hidden by default
+- Add an Event Fetching Strategy setting, fetching a repository's activity from its announced relays only (Curated) or from every maintainer's relays as well (Uncensored, the default)
+
+### Changed
+
+- Migrate the GPUI foundation to the published `gpui-pre` crates and GPUI Kit 0.6, off the zed and gpui-component git pins
+- Use the pixel avatar as the single fallback for a missing picture, sized and rounded to match the other avatars
+- Redesign the dock tab bar, using muted grey active tab, added close buttons, double-click to zoom, and removed panel toolbar
+- Connect to bootstrap relays on demand instead of at startup
+- Fetch profile metadata in batches of 100 authors, applying every requested profile in a single database query
+- Prefetch the 500 most recent profiles at startup instead of 200
+
+### Fixed
+
+- Render every avatar at one consistent size, where a surrounding border had shrunk pictures by two pixels and the pixel avatar ignored an explicit size
+- Date repositories from their repository state event, so the explore list and open repository views show the latest push instead of the announcement date
+- Fix background tasks outliving their view, so a closed repository panel or pull request view stops fetching and publishing on its own
+
+### Removed
+
+- Remove cover note support, the kind-1624 GitWorkshop and `ngit` extension outside the NIP-34
+
+## v0.1.0-alpha - 2026/09/14
+
+Initial alpha release.
+
+### Added
+
+- Create and unlock a passphrase-protected Nostr identity
+- Browse and search NIP-34 repositories with All, Popular and Recent filters
+- Scan local Git repositories and detect their NIP-34 and GRASP bindings
+- Create, publish, clone and open repositories
+- Repository view with files, commit history, branches and tags
+- Colour-coded commit diffs
+- Issues and pull requests with discussions
+- Send patches and push branches
+- Inbox for repository activity
+- Settings for appearance, theme, GRASP servers and repository scan paths
+- Release and packaging infrastructure

Cargo.toml

@@ -4,40 +4,35 @@ members = ["crates/*", "desktop"]
 default-members = ["desktop"]
 
 [workspace.package]
-version = "1.0.0"
+version = "0.2.0"
 edition = "2024"
 publish = false
 
 [workspace.dependencies]
-# GPUI
-gpui = { git = "https://github.com/zed-industries/zed" }
-gpui_platform = { git = "https://github.com/zed-industries/zed", features = ["font-kit", "x11", "wayland"] }
-gpui_linux = { git = "https://github.com/zed-industries/zed" }
-gpui_windows = { git = "https://github.com/zed-industries/zed" }
-gpui_macos = { git = "https://github.com/zed-industries/zed" }
-gpui_tokio = { git = "https://github.com/zed-industries/zed" }
-reqwest_client = { git = "https://github.com/zed-industries/zed" }
+gpui = { package = "gpui-pre", version = "0.3.8" }
+gpui_platform = { package = "gpui-pre-platform", version = "0.3.8", features = ["font-kit", "x11", "wayland"] }
+reqwest_client = { package = "gpui-pre-reqwest-client", version = "0.3.8" }
 
-# `tree-sitter-languages` enables syntax highlighting for the TextView
-# code preview (fenced code blocks are highlighted with tree-sitter).
-gpui-component = { git = "https://github.com/longbridge/gpui-component", features = ["tree-sitter-languages"] }
-gpui-base = { git = "https://github.com/longbridge/gpui-component" }
-gpui-fps = { git = "https://github.com/longbridge/gpui-component" }
+# GPUI Kit; exact pins keep the graph on the gpui-pre 0.3.8 closure that
+# native-theme-gpui 0.6.1 is verified against (0.7.3 and 0.8 pin 0.3.9).
+gpui-component = { version = "=0.7.1", features = ["tree-sitter-languages"] }
+gpui-base = "=0.7.1"
+
+native-theme = { version = "0.6.1", features = ["watch"] }
+native-theme-gpui = { version = "0.6.1", default-features = false, features = ["system-fonts"] }
 
 dock = { path = "crates/dock" }
 settings = { path = "crates/settings" }
 
 nostr = { git = "https://github.com/rust-nostr/nostr", features = ["nip59", "nip49", "nip44", "os-rng"] }
 nostr-lmdb = { git = "https://github.com/rust-nostr/nostr" }
-nostr-memory = { git = "https://github.com/rust-nostr/nostr" }
 nostr-blossom = { git = "https://github.com/rust-nostr/nostr" }
 nostr-gossip-memory = { git = "https://github.com/rust-nostr/nostr" }
 nostr-connect = { git = "https://github.com/rust-nostr/nostr" }
 nostr-sdk = { git = "https://github.com/rust-nostr/nostr" }
 
-gix = { version = "0.87.1", default-features = false, features = ["sha1", "blocking-network-client", "blocking-http-transport-reqwest-rust-tls", "worktree-mutation"] }
+gix = { version = "0.88", default-features = false, features = ["sha1", "blocking-network-client", "blocking-http-transport-reqwest-rust-tls", "worktree-mutation", "status"] }
 
-chrono = { version = "0.4.38", features = ["wasmbind"] }
 smol = "2"
 futures = "0.3"
 flume = { version = "0.11.1", default-features = false, features = ["async", "select"] }
@@ -53,16 +48,12 @@ tracing = "0.1"
 errno = { version = "0.3.14", default-features = false }
 instant = "0.1"
 
-[patch.crates-io]
-# Use stacker's psm version which may have better WASM support
-psm = { git = "https://github.com/rust-lang/stacker", branch = "master" }
-
 [profile.release]
 strip = true
 opt-level = "z"
 lto = true
 codegen-units = 1
-panic = "abort"
+panic = "unwind"
 
 [profile.profiling]
 inherits = "release"

crates/assets/Cargo.toml

@@ -8,7 +8,6 @@ publish.workspace = true
 gpui.workspace = true
 gpui-component.workspace = true
 anyhow.workspace = true
-log.workspace = true
 rust-embed.workspace = true
 
 [dev-dependencies]

crates/assets/assets/themes/signed.json

@@ -77,9 +77,9 @@
         "success.foreground": "#052E16",
         "switch.background": "#CECECE",
         "switch.thumb.background": "#FFFFFF",
-        "tab.background": "#00000000",
-        "tab.active.background": "#EBFFC1",
-        "tab.active.foreground": "#3F6212",
+        "tab.background": "#E8E8E8",
+        "tab.active.background": "#F5F5F5",
+        "tab.active.foreground": "#18181B",
         "tab.foreground": "#646464",
         "tab_bar.background": "#F0F0F0",
         "tab_bar.segmented.background": "#F0F0F0",
@@ -286,9 +286,9 @@
         "success.foreground": "#052E16",
         "switch.background": "#484848",
         "switch.thumb.background": "#0A0A0A",
-        "tab.background": "#00000000",
-        "tab.active.background": "#19200A",
-        "tab.active.foreground": "#C6FF4D",
+        "tab.background": "#2E2E2E",
+        "tab.active.background": "#2A2A2A",
+        "tab.active.foreground": "#FAFAFA",
         "tab.foreground": "#B4B4B4",
         "tab_bar.background": "#191919",
         "tab_bar.segmented.background": "#191919",

crates/assets/src/lib.rs

@@ -39,12 +39,7 @@ impl Assets {
             .filter_map(|path| {
                 let data = Self::get(path.as_ref())?;
                 let name = path.strip_prefix("themes/").unwrap_or(path.as_ref());
-                let content = match data.data {
-                    std::borrow::Cow::Borrowed(bytes) => {
-                        std::str::from_utf8(bytes).ok()?.to_owned()
-                    }
-                    std::borrow::Cow::Owned(bytes) => String::from_utf8(bytes).ok()?,
-                };
+                let content = std::str::from_utf8(data.data.as_ref()).ok()?.to_owned();
                 Some((name.to_owned(), content))
             })
             .collect()
@@ -111,61 +106,3 @@ impl IconNamed for CustomIconName {
         .into()
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn signed_theme_set() -> gpui_component::ThemeSet {
-        let themes = Assets.themes();
-        assert_eq!(themes.len(), 1, "expected exactly one embedded theme file");
-        let (name, content) = &themes[0];
-        assert_eq!(name, "signed.json");
-        serde_json::from_str(content).expect("theme file must be a valid ThemeSet")
-    }
-
-    #[test]
-    fn signed_theme_set_parses() {
-        let set = signed_theme_set();
-        let names: Vec<&str> = set.themes.iter().map(|t| t.name.as_ref()).collect();
-        assert_eq!(names, vec!["Signed Light", "Signed Dark"]);
-    }
-
-    #[test]
-    fn signed_theme_palette_applies() {
-        let set = signed_theme_set();
-        let parse = |hex: &str| gpui_component::try_parse_color(hex).unwrap();
-        for config in &set.themes {
-            let mut theme = gpui_component::Theme::default();
-            theme.apply_config(&std::rc::Rc::new(config.clone()));
-
-            assert_eq!(theme.mode, config.mode);
-            // The resolved colors must match the brand palette.
-            assert_eq!(theme.primary, parse("#C6FF4D")); // nostr-lime
-            assert_eq!(theme.success, parse("#2FBF71")); // merge
-            assert_eq!(theme.primary_active, parse("#65A30D")); // lime-600
-
-            if config.mode.is_dark() {
-                // Dark theme chrome is neutral, mirroring the light theme.
-                assert_eq!(theme.background, parse("#0A0A0A")); // neutral-950
-                assert_eq!(theme.border, parse("#27272A")); // neutral-800
-                assert_eq!(theme.green, parse("#22C55E")); // green-500
-            } else {
-                // Light theme chrome is neutral; lime is a brand accent only.
-                assert_eq!(theme.background, parse("#FFFFFF"));
-                assert_eq!(theme.foreground, parse("#18181B"));
-                assert_eq!(theme.border, parse("#E4E4E7"));
-                assert_eq!(theme.green, parse("#16A34A"));
-            }
-            // Active tab: a paler lime on light, a dim moss on dark — each
-            // paired with readable, contrasting text.
-            if config.mode.is_dark() {
-                assert_eq!(theme.tab_active, parse("#19200A")); // dim lime
-                assert_eq!(theme.tab_active_foreground, parse("#C6FF4D")); // nostr-lime
-            } else {
-                assert_eq!(theme.tab_active, parse("#EBFFC1")); // pale nostr-lime
-                assert_eq!(theme.tab_active_foreground, parse("#3F6212")); // deep-lime
-            }
-        }
-    }
-}

crates/dock/Cargo.toml

@@ -9,6 +9,7 @@ publish.workspace = true
 gpui.workspace = true
 gpui-component.workspace = true
 gpui-base.workspace = true
+settings = { path = "../settings" }
 signed_ui = { path = "../signed_ui" }
 
 [dev-dependencies]

crates/dock/src/dock_area.rs

@@ -1,7 +1,3 @@
-//! The dock-area appearance: the outer frame, the split frames, and one
-//! dock's chrome. Ported from the vendored dock's `DockArea`/`Dock` render
-//! onto `gpui_base::dock::DockAreaRenderer`.
-
 use std::cell::Cell;
 use std::ops::Deref as _;
 use std::rc::Rc;
@@ -15,23 +11,19 @@ use gpui::{
 };
 use gpui_base::dock::{
     DockArea, DockAreaRenderer, DockContext, DockEvent, DockPlacement, NodeId, PanelState,
-    PanelView, TabGroupRenderer, TilesRenderer,
+    PanelView, TabGroupRenderer,
 };
-use gpui_base::resize_handle;
-use gpui_component::scroll::ScrollbarMode;
-use gpui_component::{ActiveTheme as _, Side, StyledExt as _};
+use gpui_base::{HandleEdge, resize_handle};
+use gpui_component::ActiveTheme as _;
 
 use crate::invalid_panel::InvalidPanel;
+use crate::panel_handle;
 use crate::tab_panel::SignedTabGroupSkin;
-use crate::tiles::SignedTilesSkin;
-use crate::{TAB_BAR_HEIGHT, panel_handle};
 
-/// What every part of the skin reads, and the dock area it belongs to.
-/// Shared by reference with the per-container renderers.
+/// State the skin shares with its per-container renderers.
 pub(crate) struct SkinShared {
     area: WeakEntity<DockArea>,
     toggle_button_visible: Cell<bool>,
-    tiles_scrollbar_mode: Cell<Option<ScrollbarMode>>,
     /// The dock whose resize handle is being dragged, if any. Only one can be.
     resizing_dock: Cell<Option<DockPlacement>>,
 }
@@ -45,24 +37,13 @@ impl SkinShared {
         self.toggle_button_visible.get()
     }
 
-    pub(crate) fn tiles_scrollbar_mode(&self) -> Option<ScrollbarMode> {
-        self.tiles_scrollbar_mode.get()
-    }
-
     pub(crate) fn resizing_dock(&self) -> &Cell<Option<DockPlacement>> {
         &self.resizing_dock
     }
-
-    /// Redraw the area after a setting changed. The skin is not an entity, so
-    /// nothing else would notice.
-    pub(crate) fn notify(&self, cx: &mut App) {
-        _ = self.area.update(cx, |_, cx| cx.notify());
-    }
 }
 
 /// The Signed appearance for a [`DockArea`].
-///
-/// Install it at construction, where the area's own weak handle is available:
+/// Install it in the constructor, the only place the area's weak handle is available.
 ///
 /// ```ignore
 /// let dock = cx.new(|cx| {
@@ -80,7 +61,6 @@ impl SignedDockSkin {
             shared: Rc::new(SkinShared {
                 area: cx.weak_entity(),
                 toggle_button_visible: Cell::new(true),
-                tiles_scrollbar_mode: Cell::new(None),
                 resizing_dock: Cell::new(None),
             }),
         })
@@ -89,31 +69,11 @@ impl SignedDockSkin {
     pub(crate) fn shared(&self) -> &Rc<SkinShared> {
         &self.shared
     }
-
-    /// Whether tab bars offer the affordance that collapses a neighbouring
-    /// dock.
-    pub fn is_toggle_button_visible(&self) -> bool {
-        self.shared.is_toggle_button_visible()
-    }
-
-    pub fn set_toggle_button_visible(&self, visible: bool, cx: &mut App) {
-        self.shared.toggle_button_visible.set(visible);
-        self.shared.notify(cx);
-    }
-
-    /// When a tiles canvas shows its scrollbar. `None` follows the theme.
-    pub fn tiles_scrollbar_mode(&self) -> Option<ScrollbarMode> {
-        self.shared.tiles_scrollbar_mode()
-    }
-
-    pub fn set_tiles_scrollbar_mode(&self, mode: Option<ScrollbarMode>, cx: &mut App) {
-        self.shared.tiles_scrollbar_mode.set(mode);
-        self.shared.notify(cx);
-    }
 }
 
-/// The payload a dock's resize handle drags. It draws nothing: the handle
-/// itself is the affordance.
+/// Payload a dock's resize handle drags.
+///
+/// It draws nothing, the handle element is the visible affordance.
 #[derive(Clone)]
 struct ResizePanel;
 
@@ -144,9 +104,7 @@ impl DockAreaRenderer for SignedDockSkin {
     }
 
     fn split_frame(&self, node: NodeId, _: Axis, _: &mut Window, cx: &mut App) -> Stateful<Div> {
-        // `size_full` is what the old `StackPanel::render` carried; `flex_1`
-        // is belt and braces so the frame never collapses to zero height in
-        // an unsizing parent.
+        // `size_full` and `flex_1` stop the frame collapsing in an unsizing parent.
         div()
             .id(("dock-split-frame", node.as_u64()))
             .size_full()
@@ -163,31 +121,10 @@ impl DockAreaRenderer for SignedDockSkin {
         window: &mut Window,
         cx: &mut App,
     ) -> AnyElement {
-        let placement = dock.placement();
-        let open = dock.is_open();
-
-        // A closed left or right dock takes no space at all; a closed bottom
-        // dock keeps a strip so its tab bar stays clickable.
-        if !open && !placement.is_bottom() {
-            return div().into_any_element();
-        }
-
         div()
             .flex()
-            .flex_none()
+            .size_full()
             .relative()
-            .overflow_hidden()
-            .map(|this| match placement {
-                DockPlacement::Left | DockPlacement::Right => this.h_flex().h_full().w(dock.size()),
-                DockPlacement::Bottom => this.w_full().h(dock.size()),
-                // Base never builds a dock for the centre.
-                DockPlacement::Center => this,
-            })
-            // The closed bottom dock's strip is the tab bar itself, which is
-            // a full tab bar tall.
-            .when(!open && placement.is_bottom(), |this| {
-                this.h(TAB_BAR_HEIGHT)
-            })
             .child(content)
             .child(self.render_resize_handle(dock, window, cx))
             .child(DockResizeTracker {
@@ -197,9 +134,8 @@ impl DockAreaRenderer for SignedDockSkin {
             .into_any_element()
     }
 
-    /// The "unknown panel" message the old `InvalidPanel` drew. It answers
-    /// `dump` with the state it was handed, so a layout written by a build
-    /// that knows the panel survives a load and save here.
+    /// Placeholder for a panel this build cannot construct.
+    /// It dumps the state it was handed, so the layout survives a load and save.
     fn build_placeholder(
         &self,
         state: &PanelState,
@@ -215,10 +151,6 @@ impl DockAreaRenderer for SignedDockSkin {
     fn tab_group_renderer(&self) -> Rc<dyn TabGroupRenderer> {
         Rc::new(SignedTabGroupSkin::new(self.shared().clone()))
     }
-
-    fn tiles_renderer(&self) -> Rc<dyn TilesRenderer> {
-        Rc::new(SignedTilesSkin::new(self.shared().clone()))
-    }
 }
 
 impl SignedDockSkin {
@@ -232,7 +164,12 @@ impl SignedDockSkin {
         let shared = self.shared().clone();
 
         resize_handle("resize-handle", placement.axis())
-            .when(placement.is_left(), |this| this.placement(Side::Left))
+            .when(placement.is_left(), |this| {
+                this.inside(HandleEdge::Trailing)
+            })
+            .when(placement.is_right() || placement.is_bottom(), |this| {
+                this.inside(HandleEdge::Leading)
+            })
             .on_drag(ResizePanel, move |info, _, _, cx| {
                 cx.stop_propagation();
                 shared.resizing_dock().set(Some(placement));
@@ -241,10 +178,8 @@ impl SignedDockSkin {
     }
 }
 
-/// Turns the window's mouse stream into dock resizing. A resize is driven
-/// by pointer moves anywhere in the window, so this paints nothing and
-/// exists for its `paint` hook — the only place a window-level mouse
-/// listener can be registered.
+/// Turns the window's mouse stream into dock resizing.
+/// It draws nothing, the `paint` hook is the only window listener registration point.
 struct DockResizeTracker {
     dock: DockContext,
     shared: Rc<SkinShared>,
@@ -310,10 +245,8 @@ impl Element for DockResizeTracker {
                 if !phase.bubble() || shared.resizing_dock().get() != Some(placement) {
                     return;
                 }
-                // Dragging a closed dock's handle reopens it. The live
-                // state is read rather than the render-time snapshot in
-                // `dock`, which would still say closed for the rest of the
-                // frame and toggle it shut again on the next move.
+                // Dragging a closed dock's handle reopens it.
+                // Read the live state, the snapshot in `dock` would toggle it shut again.
                 let open = shared
                     .area()
                     .upgrade()
@@ -332,8 +265,8 @@ impl Element for DockResizeTracker {
                     return;
                 }
                 shared.resizing_dock().set(None);
-                // The size lives on the dock, not in the layout tree, so
-                // nothing else tells a subscriber to persist it.
+                // The size lives on the dock, not the layout tree.
+                // Nothing else tells a subscriber to persist it.
                 _ = shared
                     .area()
                     .update(cx, |_, cx| cx.emit(DockEvent::LayoutChanged));

crates/dock/src/invalid_panel.rs

@@ -7,10 +7,8 @@ use gpui_component::ActiveTheme as _;
 
 use crate::Panel;
 
-/// Stands in for a panel this build cannot construct. It reports the
-/// original [`PanelState`] from [`dump`](gpui_base::dock::Panel::dump), so
-/// a layout written by a build that knows the panel survives a load and
-/// save here.
+/// Stands in for a panel this build cannot construct.
+/// It returns the state it was handed, so the layout survives a load and save.
 pub(crate) struct InvalidPanel {
     name: SharedString,
     focus_handle: FocusHandle,

crates/dock/src/lib.rs

@@ -1,38 +1,36 @@
-//! The Signed dock skin.
-//!
-//! The dock engine lives upstream (`gpui_base::dock` owns the layout tree,
-//! drags, zoom and persistence); this crate is the appearance the app used
-//! to vendor from gpui-component — a 44px tab bar that doubles as the
-//! window title bar, with pill tabs, window controls, title-bar dragging
-//! and previous/next tab buttons.
-//!
-//! Everything `gpui_component::dock` exports is re-exported here, so the app
-//! keeps importing the dock from a single place.
+use std::sync::Arc;
 
-use gpui::{Pixels, px};
+use gpui::{Context, Pixels, Window, px};
+use gpui_base::dock::PanelView;
 
 mod dock_area;
 mod invalid_panel;
 mod tab_panel;
-mod tiles;
 mod window_controls;
 
 pub use dock_area::SignedDockSkin;
 pub use gpui_component::dock::{
-    AnyDrag, BasePanel, BasePanelView, ClosePanel, DockArea, DockAreaState, DockContext, DockEvent,
-    DockLayout, DockPlacement, DockState, DragPanel, DropIndicator, DropPlaceholderBounds,
-    DropTarget, Panel, PanelControl, PanelEvent, PanelHandle, PanelInfo, PanelState, PanelStyle,
-    PanelView, TitleStyle, ToggleZoom, panel_handle, register_panel,
+    BasePanel, DockArea, DockEvent, DockLayout, DockPlacement, Panel, PanelEvent, panel_handle,
 };
 
+/// Add an already-wrapped panel handle to the center of `area`.
+///
+/// Every panel entry point opens its panel there.
+pub fn add_center_panel(
+    area: &mut DockArea,
+    panel: Arc<dyn PanelView>,
+    window: &mut Window,
+    cx: &mut Context<DockArea>,
+) {
+    area.add_panel_view(panel, DockPlacement::Center, None, window, cx);
+}
+
 /// The fixed height of the tab bar, which doubles as the window title bar.
 pub const TAB_BAR_HEIGHT: Pixels = px(44.);
 
-/// Minimal i18n shim replacing gpui-component's `rust_i18n::t!()`, keeping the
-/// same `Dock.*` keys resolved to English so the crate has no i18n dependency.
+/// i18n shim resolving `Dock.*` keys to English, so the crate has no i18n dependency.
 pub(crate) fn t(key: &'static str) -> &'static str {
     match key {
-        "Dock.Unnamed" => "Unnamed",
         "Dock.Close" => "Close",
         "Dock.Zoom In" => "Zoom In",
         "Dock.Zoom Out" => "Zoom Out",

crates/dock/src/tab_panel.rs

@@ -1,13 +1,3 @@
-//! The Signed appearance for a tab group.
-//!
-//! `gpui_base::dock::TabGroup` owns the behavior — membership, the displayed
-//! tab, drag hit-testing, the zoom flag — and draws none of it. Everything
-//! visible is here, ported from the vendored dock: the pill tab bar that
-//! doubles as the window title bar (with window controls, title-bar
-//! dragging, and previous/next tab buttons), the toolbar, the ellipsis menu,
-//! the dock collapse affordance, the drop placeholder, and the styled drag
-//! preview.
-
 use std::cell::Cell;
 use std::rc::Rc;
 use std::sync::Arc;
@@ -15,9 +5,9 @@ use std::time::Duration;
 
 use gpui::prelude::FluentBuilder as _;
 use gpui::{
-    Anchor, Animation, AnimationExt as _, AnyElement, AnyView, App, AppContext as _, Bounds,
-    Context, Div, Empty, InteractiveElement as _, IntoElement, ParentElement as _, Pixels, Point,
-    Render, ScrollHandle, SharedString, Stateful, StatefulInteractiveElement as _, StyleRefinement,
+    Animation, AnimationExt as _, AnyElement, AnyView, App, AppContext as _, Bounds, Context, Div,
+    Empty, InteractiveElement as _, IntoElement, ParentElement as _, Pixels, Point, Render,
+    ScrollHandle, SharedString, Stateful, StatefulInteractiveElement as _, StyleRefinement,
     Styled as _, Window, div, px, size,
 };
 use gpui_base::dock::{
@@ -27,23 +17,27 @@ use gpui_base::dock::{
 use gpui_base::{ElementExt, InteractiveElementExt, Tab, Tabs};
 use gpui_component::animation::{Lerp as _, ease_out_cubic};
 use gpui_component::button::{Button, ButtonVariants as _};
-use gpui_component::menu::DropdownMenu as _;
-use gpui_component::{
-    ActiveTheme as _, Disableable as _, IconName, Selectable as _, Sizable as _, h_flex, v_flex,
-};
+use gpui_component::dock::{ClosePanel, PanelControl, PanelHandle, ToggleZoom};
+use gpui_component::{ActiveTheme as _, Disableable as _, IconName, Sizable as _, h_flex, v_flex};
+use settings::{SettingsStore, TabBarSettings};
 use signed_ui::title_bar_drag_handlers;
 
 use crate::dock_area::SkinShared;
-use crate::{
-    ClosePanel, PanelControl, PanelHandle, TAB_BAR_HEIGHT, ToggleZoom, t, window_controls,
-};
+use crate::{TAB_BAR_HEIGHT, t, window_controls};
 
-/// The size the styled drag preview occupies, reported to base so a drop
-/// placeholder knows where to fly in from.
 const DRAG_PREVIEW_SIZE: gpui::Size<gpui::Pixels> = size(px(96.), px(30.));
+const COLLAPSED_TAB_BAR_SELECTOR: &str = "signed-dock-collapsed-tab-bar";
+const ACTIVE_TAB_SELECTOR: &str = "signed-dock-active-tab";
+const ACTIVE_TAB_CLOSE_SELECTOR: &str = "signed-dock-active-tab-close";
+const TAB_HOVER_GROUP: &str = "signed-dock-tab";
+const NAVIGATION_BUTTONS_TAB_THRESHOLD: usize = 10;
 
-/// A panel's title, or its registered name when it reached base without this
-/// crate's handle and so carries no presentation. See [`PanelHandle::of`].
+/// Whether a group's prev/next buttons should be drawn.
+fn navigation_buttons_visible(hide_navigation_buttons: bool, panels_len: usize) -> bool {
+    !hide_navigation_buttons && panels_len > NAVIGATION_BUTTONS_TAB_THRESHOLD
+}
+
+/// A panel's title, or its registered name when the panel has no handle.
 pub(crate) fn panel_title(
     panel: &Arc<dyn BasePanelView>,
     window: &mut Window,
@@ -56,26 +50,20 @@ pub(crate) fn panel_title(
 }
 
 /// The preview that follows the cursor while a panel is dragged.
-///
-/// `gpui_base::dock::DragPanel` is the payload and draws nothing; this is the
-/// appearance half, reintroduced here.
 struct DragPanelPreview {
     panel: Arc<dyn BasePanelView>,
 }
 
 impl Render for DragPanelPreview {
     fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        div()
+        h_flex()
             .id("drag-panel")
             .cursor_grab()
-            .py_1()
-            .px_3()
-            .w_24()
-            .overflow_hidden()
+            .p_1()
             .whitespace_nowrap()
             .border_1()
             .border_color(cx.theme().border)
-            .rounded(cx.theme().radius)
+            .rounded(cx.theme().radius_lg)
             .text_color(cx.theme().tab_foreground)
             .bg(cx.theme().tokens.tab_active)
             .opacity(0.75)
@@ -83,31 +71,29 @@ impl Render for DragPanelPreview {
     }
 }
 
-/// Where the zoom affordance goes for the group's displayed panel, or `None`
-/// when there is none to offer. Both [`Panel::zoom_control`] (where) and
-/// [`gpui_base::dock::Panel::zoomable`] (whether) must pass; base refuses a
-/// zoom that fails the latter.
-fn zoom_control(group: &TabGroupContext, cx: &App) -> Option<PanelControl> {
-    let panel = group.active_panel()?;
+/// The zoom affordance `panel` offers, if any.
+///
+/// The panel must offer a control and be zoomable, base refuses a zoom otherwise.
+fn panel_zoom_control(panel: &Arc<dyn BasePanelView>, cx: &App) -> Option<PanelControl> {
     panel
         .zoomable(cx)
         .then(|| PanelHandle::of(panel).and_then(|handle| handle.zoom_control(cx)))
         .flatten()
 }
 
-/// The left-most, top-most tab group in a container — where a left dock's
-/// collapse affordance goes. Mirrors the old `StackPanel::left_top_tab_panel`.
+/// The left-most, top-most tab group in a container.
+///
+/// A left dock's collapse button lives in this group.
 fn left_top_group(node: &PaneNode) -> Option<NodeId> {
     match node.kind() {
         PaneRef::Tabs { .. } => Some(node.id()),
         PaneRef::Split { children, .. } => children.first().and_then(left_top_group),
-        PaneRef::Tiles { .. } => None,
     }
 }
 
-/// The right-most, top-most tab group. A vertical split stacks its children,
-/// so its *first* child is the top one; a horizontal split's last child is
-/// the right-most. Mirrors the old `StackPanel::right_top_tab_panel`.
+/// The right-most, top-most tab group.
+///
+/// A vertical split picks its first child, a horizontal split picks its last.
 fn right_top_group(node: &PaneNode) -> Option<NodeId> {
     match node.kind() {
         PaneRef::Tabs { .. } => Some(node.id()),
@@ -116,27 +102,67 @@ fn right_top_group(node: &PaneNode) -> Option<NodeId> {
             gpui::Axis::Horizontal => children.last(),
         }
         .and_then(right_top_group),
-        PaneRef::Tiles { .. } => None,
     }
 }
 
-/// One tab group's appearance. Built once per container, so the tab bar's
-/// scroll position and measured title-bar geometry belong to the group.
+/// The bottom or right dock whose root tab group is this one, if any.
+///
+/// Base keeps a dock's last group, so the skin removes these docks as a whole.
+fn dock_root_group(
+    shared: &SkinShared,
+    group: &TabGroupContext,
+    cx: &App,
+) -> Option<DockPlacement> {
+    let area = shared.area().upgrade()?;
+    let area = area.read(cx);
+
+    [DockPlacement::Bottom, DockPlacement::Right]
+        .into_iter()
+        .find(|placement| {
+            area.layout(*placement)
+                .is_some_and(|tree| tree.root().id() == group.node())
+        })
+}
+
+/// Close `panel`, removing its dock instead when base would refuse an empty one.
+///
+/// A bottom or right dock's only panel is that case, so the whole dock goes.
+fn close_panel(
+    shared: &SkinShared,
+    group: &TabGroupContext,
+    panel: &Arc<dyn BasePanelView>,
+    window: &mut Window,
+    cx: &mut App,
+) {
+    if !panel.closable(cx) {
+        return;
+    }
+
+    let dock = (group.panels().len() <= 1)
+        .then(|| dock_root_group(shared, group, cx))
+        .flatten();
+
+    match dock {
+        Some(placement) => {
+            _ = shared.area().update(cx, |area, cx| {
+                area.remove_dock(placement, window, cx);
+            });
+        }
+        None => group.close(panel.panel_id(cx), window, cx),
+    }
+}
+
+/// One tab group's appearance, built once per container so its geometry is its own.
 pub(crate) struct SignedTabGroupSkin {
     shared: Rc<SkinShared>,
     scroll_handle: ScrollHandle,
-    /// The displayed tab the last frame drew, so a change scrolls the new tab
-    /// into view.
+    /// The tab shown last frame, so a change scrolls the new one into view.
     last_active_ix: Cell<Option<usize>>,
-    /// Bounds of the title bar row (the wrapper around the tab bar), in
-    /// window coordinates. Measured via `on_prepaint` to position the
-    /// title-bar drag overlay.
+    /// Bounds of the title bar row, measured to place the title-bar drag overlay.
     title_bar_bounds: Rc<Cell<Option<Bounds<Pixels>>>>,
-    /// Bounds of the tab bar's trailing empty space (right after the last
-    /// tab), which marks where the draggable region starts.
+    /// Bounds of the empty strip after the last tab, where the drag region starts.
     title_bar_strip_bounds: Rc<Cell<Option<Bounds<Pixels>>>>,
-    /// Bounds of the tab bar's suffix (toolbar) area, which marks where the
-    /// draggable region ends.
+    /// Bounds of the suffix area, where the drag region ends.
     title_bar_suffix_bounds: Rc<Cell<Option<Bounds<Pixels>>>>,
 }
 
@@ -152,9 +178,8 @@ impl SignedTabGroupSkin {
         }
     }
 
-    /// A group that is the left dock's whole content with a single panel
-    /// draws no chrome at all — the vendored dock rendered such a panel bare,
-    /// and the sidebar is one.
+    /// A group that is the left dock's only group, with one panel, draws no chrome.
+    /// The vendored dock rendered such a panel bare and the sidebar is one.
     fn is_plain_sidebar_group(&self, group: &TabGroupContext, cx: &mut App) -> bool {
         let Some(area) = self.shared.area().upgrade() else {
             return false;
@@ -169,38 +194,21 @@ impl SignedTabGroupSkin {
         left == group.node() && group.panels().len() == 1
     }
 
-    /// The bottom or right dock whose root tab group this group is, if any.
+    /// The tab's drag payload, or `None` when the group must not be rearranged.
     ///
-    /// Base bars a dock's only group from being dragged or closed, so the
-    /// dock cannot be emptied — but a bottom/right panel is supposed to be
-    /// closable, so the skin routes around the bar for these groups.
-    fn is_dock_root_group(&self, group: &TabGroupContext, cx: &App) -> Option<DockPlacement> {
-        let area = self.shared.area().upgrade()?;
-        let area = area.read(cx);
-        [DockPlacement::Bottom, DockPlacement::Right]
-            .into_iter()
-            .find(|placement| {
-                area.layout(*placement)
-                    .is_some_and(|tree| tree.root().id() == group.node())
-            })
-    }
-
-    /// The drag payload for the tab at `ix`, or `None` when this group must
-    /// not be rearranged. A locked group is never draggable; a group that is
-    /// a bottom/right dock's only content still is, because the center is
-    /// always there to land in.
+    /// A locked group never is, a bottom or right dock root always is.
     fn tab_drag(&self, group: &TabGroupContext, ix: usize, cx: &App) -> Option<DragPanel> {
         if group.is_locked() {
             return None;
         }
-        if !group.is_draggable() && self.is_dock_root_group(group, cx).is_none() {
+        if !group.is_draggable() && dock_root_group(&self.shared, group, cx).is_none() {
             return None;
         }
         group.drag_panel(ix, cx)
     }
 
-    /// Whether a dock's collapse affordance belongs in *this* group's tab
-    /// bar, and which way it points. `None` means this group draws none.
+    /// A dock's collapse button for this group's bar, or `None` when it does not belong.
+    /// The icon direction depends on whether the dock is open.
     fn dock_toggle_button(
         &self,
         placement: DockPlacement,
@@ -213,8 +221,7 @@ impl SignedTabGroupSkin {
 
         let area = self.shared.area().upgrade()?;
         let area = area.read(cx);
-        // A dock that does not exist is not collapsible, so this covers the
-        // old `left_dock.is_some()` test too.
+        // A missing dock is not collapsible, this also covers the old `left_dock.is_some()` test.
         if !area.is_dock_collapsible(placement) {
             return None;
         }
@@ -229,7 +236,7 @@ impl SignedTabGroupSkin {
             DockPlacement::Bottom => area
                 .layout(DockPlacement::Bottom)
                 .and_then(|tree| left_top_group(tree.root())),
-            DockPlacement::Center => None,
+            DockPlacement::Center => return None,
         };
         if designated != Some(group.node()) {
             return None;
@@ -263,16 +270,23 @@ impl SignedTabGroupSkin {
         )
     }
 
-    /// The previous/next tab buttons shown in the tab bar's leading prefix.
-    /// Always rendered, disabled at the ends of the strip (or collapsed).
-    fn render_prev_next_tab_buttons(
-        &self,
-        group: &TabGroupContext,
-        _cx: &mut App,
-    ) -> impl IntoElement {
+    /// The previous and next tab buttons in the tab bar's leading prefix.
+    ///
+    /// Hidden by default, and only offered for crowded strips where the active
+    /// tab may have scrolled out of view. Disabled at the strip ends or collapsed.
+    fn render_prev_next_tab_buttons(&self, group: &TabGroupContext, cx: &mut App) -> AnyElement {
         let collapsed = group.is_collapsed();
         let active_ix = group.active_ix();
         let panels_len = group.panels().len();
+
+        let hidden = SettingsStore::try_global(cx)
+            .map(|store| store.read(cx).settings().tab_bar.hide_navigation_buttons)
+            .unwrap_or_else(|| TabBarSettings::default().hide_navigation_buttons);
+
+        if !navigation_buttons_visible(hidden, panels_len) {
+            return Empty.into_any_element();
+        }
+
         let prev_enabled = !collapsed && active_ix > 0;
         let next_enabled = !collapsed && active_ix + 1 < panels_len;
 
@@ -304,102 +318,10 @@ impl SignedTabGroupSkin {
                         move |_, window, cx| group.select_tab(active_ix + 1, window, cx)
                     }),
             )
+            .into_any_element()
     }
 
-    /// The trailing controls: the panel's own buttons, the zoom affordance,
-    /// and the ellipsis menu.
-    fn render_toolbar(
-        &self,
-        group: &TabGroupContext,
-        window: &mut Window,
-        cx: &mut App,
-    ) -> impl IntoElement {
-        if group.is_collapsed() {
-            return div();
-        }
-
-        let zoomed = group.is_zoomed();
-        let handle = group.active_panel().and_then(PanelHandle::of);
-        let control = zoom_control(group, cx);
-        let toolbar_zoom = control.is_some_and(|control| control.toolbar_visible());
-        let menu_zoom = control.is_some_and(|control| control.menu_visible());
-        // A bottom/right dock's only panel cannot be closed through the
-        // group (base keeps a dock's last group), but the skin handles that
-        // close by removing the whole dock, so the item is offered.
-        let closable = group.is_closable()
-            || (self.is_dock_root_group(group, cx).is_some()
-                && group.active_panel().is_some_and(|panel| panel.closable(cx)));
-        let buttons = handle.and_then(|handle| handle.toolbar_buttons(window, cx));
-        let panel = handle.map(|handle| handle.panel());
-
-        h_flex()
-            .gap_1()
-            .occlude()
-            .when_some(buttons, |this, buttons| {
-                this.children(
-                    buttons
-                        .into_iter()
-                        .map(|button| button.small().ghost().tab_stop(false)),
-                )
-            })
-            .map(|this| {
-                let value = if zoomed {
-                    Some(("zoom-out", IconName::Minimize, t("Dock.Zoom Out")))
-                } else if toolbar_zoom {
-                    Some(("zoom-in", IconName::Maximize, t("Dock.Zoom In")))
-                } else {
-                    None
-                };
-
-                if let Some((id, icon, tooltip)) = value {
-                    this.child(
-                        Button::new(id)
-                            .icon(icon)
-                            .small()
-                            .ghost()
-                            .tab_stop(false)
-                            .tooltip_with_action(tooltip, &ToggleZoom, None)
-                            .selected(zoomed)
-                            .on_click({
-                                let group = group.clone();
-                                move |_, window, cx| group.toggle_zoom(window, cx)
-                            }),
-                    )
-                } else {
-                    this
-                }
-            })
-            .child(
-                Button::new("menu")
-                    .icon(IconName::Ellipsis)
-                    .small()
-                    .ghost()
-                    .tab_stop(false)
-                    .dropdown_menu(move |menu, window, cx| {
-                        menu.when_some(panel.clone(), |menu, panel| {
-                            panel.dropdown_menu(menu, window, cx)
-                        })
-                        .separator()
-                        .menu_with_disabled(
-                            if zoomed {
-                                t("Dock.Zoom Out")
-                            } else {
-                                t("Dock.Zoom In")
-                            },
-                            Box::new(ToggleZoom),
-                            !menu_zoom,
-                        )
-                        .when(closable, |menu| {
-                            menu.separator().menu(t("Dock.Close"), Box::new(ClosePanel))
-                        })
-                    })
-                    .anchor(Anchor::TopRight),
-            )
-    }
-
-    /// One tab of the pill strip. While collapsed, tabs lose the active
-    /// style and all interactions, and the strip becomes the way a closed
-    /// bottom dock is opened again.
+    /// One tab of the pill strip.
     #[allow(clippy::too_many_arguments)]
     fn render_tab(
         &self,
@@ -415,26 +337,73 @@ impl SignedTabGroupSkin {
         let droppable = group.is_droppable();
         let drag = self.tab_drag(group, ix, cx);
         let handle = PanelHandle::of(&panel);
+        let id = SharedString::from(format!("close-tab:{}:{ix}", group.node().as_u64()));
+
+        let closable = !collapsed
+            && (group.is_closable()
+                || (dock_root_group(&self.shared, group, cx).is_some() && panel.closable(cx)));
+
+        // Whether a double-click zooms this tab in.
+        let can_zoom_in = panel_zoom_control(&panel, cx).is_some();
 
         Tab::new(ix)
-            .h_6()
-            .px_3()
-            .text_sm()
-            .whitespace_nowrap()
+            .group(TAB_HOVER_GROUP)
+            .when(active, |this| {
+                this.debug_selector(|| ACTIVE_TAB_SELECTOR.to_string())
+            })
             .flex()
             .items_center()
-            .justify_center()
-            .gap_1()
             .flex_shrink_0()
+            .h_7()
+            .min_w_40()
+            .gap_1()
+            .px_1p5()
+            .text_sm()
             .overflow_hidden()
             .rounded(cx.theme().radius)
-            .text_color(cx.theme().foreground)
-            .map(|this| match handle.and_then(|handle| handle.tab_name(cx)) {
-                Some(tab_name) => this.child(tab_name),
-                None => this.child(panel_title(&panel, window, cx)),
+            .text_color(cx.theme().tab_foreground)
+            .child(
+                h_flex()
+                    .flex_1()
+                    .h_6()
+                    .items_center()
+                    .overflow_hidden()
+                    .whitespace_nowrap()
+                    .map(|this| match handle.and_then(|handle| handle.tab_name(cx)) {
+                        Some(tab_name) => this.child(tab_name),
+                        None => this.child(panel_title(&panel, window, cx)),
+                    }),
+            )
+            .when(closable, |this| {
+                this.child(
+                    div()
+                        .flex_shrink_0()
+                        .when(active, |this| {
+                            this.debug_selector(|| ACTIVE_TAB_CLOSE_SELECTOR.to_string())
+                        })
+                        .when(!active, |this| {
+                            this.invisible()
+                                .group_hover(TAB_HOVER_GROUP, |this| this.visible())
+                        })
+                        .child(
+                            Button::new(id)
+                                .icon(IconName::Close)
+                                .tooltip(t("Dock.Close"))
+                                .ghost()
+                                .xsmall()
+                                .tab_stop(false)
+                                .on_click({
+                                    let group = group.clone();
+                                    let shared = self.shared.clone();
+                                    let panel = panel.clone();
+                                    move |_, window, cx| {
+                                        cx.stop_propagation();
+                                        close_panel(&shared, &group, &panel, window, cx);
+                                    }
+                                }),
+                        ),
+                )
             })
-            // Pill presentation: the selected tab is the filled pill, the
-            // rest are transparent until hovered.
             .styles(|styles| {
                 styles.selected(|style| {
                     style
@@ -446,24 +415,31 @@ impl SignedTabGroupSkin {
                 if active {
                     this
                 } else {
-                    this.text_color(cx.theme().secondary_foreground)
-                        .bg(cx.theme().secondary_hover)
+                    this.text_color(cx.theme().tab_foreground)
+                        .bg(cx.theme().tab)
                 }
             })
             .selected(active)
             .on_click({
                 let group = group.clone();
                 let area = self.shared.area().clone();
-                move |_, window, cx| {
+                move |event, window, cx| {
                     group.select_tab(ix, window, cx);
 
-                    // Clicking the strip of a collapsed bottom dock is how it
-                    // is opened again.
+                    // Clicking the strip of a collapsed bottom dock reopens it.
                     if is_bottom_dock && collapsed {
                         _ = area.update(cx, |area, cx| {
                             area.toggle_dock(DockPlacement::Bottom, window, cx);
                         });
+                        return;
                     }
+
+                    // A double-click zooms the tab's panel
+                    if event.click_count() < 2 || (!group.is_zoomed() && !can_zoom_in) {
+                        return;
+                    }
+
+                    group.toggle_zoom(window, cx);
                 }
             })
             .when(!collapsed, |this| {
@@ -509,9 +485,8 @@ impl SignedTabGroupSkin {
             })
     }
 
-    /// The strip after the last tab: a drop target for panels and host-owned
-    /// drag items. Its left edge (right after the last tab) marks the start
-    /// of the title-bar drag overlay.
+    /// The strip after the last tab, a drop target for panels and other drag items.
+    /// Its left edge marks where the title-bar drag overlay starts.
     fn render_empty_space(
         &self,
         group: &TabGroupContext,
@@ -541,9 +516,8 @@ impl SignedTabGroupSkin {
                     let group = group.clone();
                     let node = group.node();
                     move |drag: &DragPanel, window, cx| {
-                        // A panel dropped past its own last tab lands in the
-                        // final slot; one from elsewhere is appended in the
-                        // background.
+                        // A panel dropped past its own last tab lands in the final slot.
+                        // A panel from elsewhere is appended in the background.
                         let ix = (drag.source() == node).then(|| tabs_count - 1);
                         group.drop_panel(drag.clone(), ix, false, window, cx);
                     }
@@ -563,38 +537,25 @@ impl SignedTabGroupSkin {
 
 impl TabGroupRenderer for SignedTabGroupSkin {
     fn frame(&self, group: &TabGroupContext, _: &mut Window, cx: &mut App) -> Stateful<Div> {
-        let control = zoom_control(group, cx);
-        // An emptied group — its last panel was dragged away — draws nothing,
-        // so an emptied dock does not leave a bare tab bar behind.
+        let control = group
+            .active_panel()
+            .and_then(|panel| panel_zoom_control(panel, cx));
+        // An emptied group draws nothing, so no bare tab bar is left behind.
         if group.panels().is_empty() {
             return div().id("tab-panel");
         }
-        // Closing the only panel of a bottom/right dock would leave an
-        // empty dock, which base refuses; the skin removes the dock instead.
-        let dock_to_remove = (group.panels().len() <= 1)
-            .then(|| self.is_dock_root_group(group, cx))
-            .flatten();
         let shared = self.shared.clone();
 
-        // `v_flex`, not `div`: gpui's default display is Block, and in block
-        // layout a child's `flex_grow` is ignored — the content region below
-        // the tab bar would resolve to zero height.
+        // `v_flex`, a plain `div` ignores `flex_grow` and the content would collapse.
         v_flex()
             .id("tab-panel")
             .size_full()
             .overflow_hidden()
             .bg(cx.theme().tokens.background)
-            // A collapsed group is a strip of tabs with no content, and the
-            // actions act on content.
             .when(!group.is_collapsed(), |this| {
                 this.on_action({
                     let group = group.clone();
                     move |_: &ToggleZoom, window, cx| {
-                        // The affordance decides the control, so a panel
-                        // offering none is not zoomed *in* by the keybinding
-                        // either. Zooming out is never refused: a panel that
-                        // stopped offering the control while zoomed would
-                        // otherwise strand the user with no way back.
                         if !group.is_zoomed() && control.is_none() {
                             return;
                         }
@@ -608,18 +569,7 @@ impl TabGroupRenderer for SignedTabGroupSkin {
                         let Some(panel) = group.active_panel() else {
                             return;
                         };
-                        if !panel.closable(cx) {
-                            return;
-                        }
-                        let panel = panel.panel_id(cx);
-                        match dock_to_remove {
-                            Some(placement) => {
-                                _ = shared.area().update(cx, |area, cx| {
-                                    area.remove_dock(placement, window, cx);
-                                });
-                            }
-                            None => group.close(panel, window, cx),
-                        }
+                        close_panel(&shared, &group, panel, window, cx);
                     }
                 })
             })
@@ -628,8 +578,7 @@ impl TabGroupRenderer for SignedTabGroupSkin {
     fn content_frame(&self, group: &TabGroupContext, _: &mut Window, _: &mut App) -> Stateful<Div> {
         v_flex()
             .id("active-panel")
-            // A collapsed group draws its tab strip and nothing else, so the
-            // content region must not claim any space.
+            // A collapsed group draws its tab strip only, so the content claims no space.
             .when(!group.is_collapsed(), |this| this.flex_1())
     }
 
@@ -639,14 +588,12 @@ impl TabGroupRenderer for SignedTabGroupSkin {
         window: &mut Window,
         cx: &mut App,
     ) -> AnyElement {
-        // An emptied group draws no tab bar; the app prunes the emptied
-        // bottom/right dock a moment later.
+        // An emptied group draws no tab bar, the app prunes the emptied dock later.
         if group.panels().is_empty() {
             return Empty.into_any_element();
         }
 
-        // The sidebar group draws no chrome at all, like the vendored dock's
-        // bare `DockItem::Panel`.
+        // The sidebar group draws no chrome, like the vendored `DockItem::Panel`.
         if self.is_plain_sidebar_group(group, cx) {
             return Empty.into_any_element();
         }
@@ -660,22 +607,27 @@ impl TabGroupRenderer for SignedTabGroupSkin {
         let right_dock_button = self.dock_toggle_button(DockPlacement::Right, group, cx);
         let is_bottom_dock = bottom_dock_button.is_some();
 
-        // macOS: the traffic lights overlay the window's top-left corner.
-        // Only the group whose tab bar actually sits under them reserves the
-        // space — the center's left-most, top-most group when the left dock
-        // is closed or absent.
+        // On macOS the traffic lights overlay the window's top-left corner, so the
+        // tab bar under them reserves the space. That is the center's top-left group
+        // when the left dock is closed or absent, and the zoomed group otherwise:
+        // a zoom fills the whole area, hiding the docks the frame would draw.
         let needs_traffic_light_padding = cfg!(target_os = "macos")
             && self.shared.area().upgrade().is_some_and(|area| {
                 let area = area.read(cx);
-                !area.is_dock_open(DockPlacement::Left)
-                    && area
-                        .layout(DockPlacement::Center)
-                        .and_then(|tree| left_top_group(tree.root()))
-                        == Some(group.node())
+                match area.zoomed_group() {
+                    Some(zoomed) => zoomed == group.node(),
+                    None => {
+                        !area.is_dock_open(DockPlacement::Left)
+                            && area
+                                .layout(DockPlacement::Center)
+                                .and_then(|tree| left_top_group(tree.root()))
+                                == Some(group.node())
+                    }
+                }
             });
 
-        // Bring a newly displayed tab into view. The group owns selection
-        // now, so the skin notices the change rather than being told about it.
+        // Bring a newly displayed tab into view.
+        // The group owns selection, so the skin watches for the change itself.
         let displayed = group.active_panel().map(|panel| panel.panel_id(cx));
         let visible: Vec<usize> = group
             .panels()
@@ -690,10 +642,8 @@ impl TabGroupRenderer for SignedTabGroupSkin {
             self.scroll_handle.scroll_to_item(visible_ix);
         }
 
-        // The tab strip lays out at content width, so the area after the
-        // last tab has no element. Cover that dead zone (last tab's right
-        // edge to suffix's left edge) with a measured overlay so the whole
-        // non-interactive area can drag the window.
+        // The tab strip ends at the last tab, the bar has no element after it.
+        // Cover that dead zone with an overlay so it can drag the window.
         let drag_overlay = match (
             self.title_bar_bounds.get(),
             self.title_bar_strip_bounds.get(),
@@ -728,8 +678,7 @@ impl TabGroupRenderer for SignedTabGroupSkin {
                 if !panel.visible(cx) {
                     return None;
                 }
-                // A collapsed group shows no tab as active: the strip is a
-                // way back in, not a selection.
+                // Collapsed tabs never show as active, the strip only reopens the dock.
                 if collapsed {
                     active = false;
                 }
@@ -760,7 +709,16 @@ impl TabGroupRenderer for SignedTabGroupSkin {
                     .child(
                         Tabs::new("tab-bar")
                             .px(px(-1.))
-                            .h(TAB_BAR_HEIGHT)
+                            // A collapsed group stands in for a closed bottom dock,
+                            // which base gives only its reserved strip. The bar keeps
+                            // its own height there rather than the title-bar height,
+                            // so it fits instead of being clipped away.
+                            .when(!collapsed, |this| this.h(TAB_BAR_HEIGHT))
+                            // Only a collapsed (bottom) dock tags its bar, so the
+                            // selector is unique when a test measures it.
+                            .when(collapsed, |this| {
+                                this.debug_selector(|| COLLAPSED_TAB_BAR_SELECTOR.to_string())
+                            })
                             .flex()
                             .items_center()
                             .text_color(cx.theme().tab_foreground)
@@ -768,7 +726,7 @@ impl TabGroupRenderer for SignedTabGroupSkin {
                                 h_flex()
                                     .items_center()
                                     .top_0()
-                                    // Right -1 for avoid border overlap with the first tab
+                                    // -1 px so the border does not overlap the first tab.
                                     .right(-px(1.))
                                     .h_full()
                                     .gap_2()
@@ -814,7 +772,6 @@ impl TabGroupRenderer for SignedTabGroupSkin {
                                                 .and_then(PanelHandle::of)
                                                 .and_then(|handle| handle.title_suffix(window, cx)),
                                         )
-                                        .child(self.render_toolbar(group, window, cx))
                                         .children(right_dock_button),
                                 )
                             }),
@@ -852,9 +809,7 @@ impl TabGroupRenderer for SignedTabGroupSkin {
         cx: &mut App,
     ) -> Option<AnyElement> {
         let (from, to) = (indicator.from(), indicator.to());
-        // The placeholder animates from wherever it was to where the drop
-        // would land, so its own element is positioned at the destination and
-        // the animation only has to walk the difference back to zero.
+        // The element sits at the drop target, the animation walks back from the source.
         let offset = from.origin() - to.origin();
 
         Some(
@@ -886,3 +841,123 @@ impl TabGroupRenderer for SignedTabGroupSkin {
         )
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use gpui::{
+        App, AppContext as _, Context, Empty, EventEmitter, FocusHandle, Focusable, IntoElement,
+        Render, TestAppContext, Window, px,
+    };
+    use gpui_base::dock::{DockArea, DockLayout, DockPlacement, PanelEvent};
+
+    use super::{COLLAPSED_TAB_BAR_SELECTOR, navigation_buttons_visible};
+    use crate::{BasePanel, Panel, SignedDockSkin, panel_handle};
+
+    struct Probe {
+        focus_handle: FocusHandle,
+    }
+
+    impl Probe {
+        fn new(cx: &mut Context<Self>) -> Self {
+            Self {
+                focus_handle: cx.focus_handle(),
+            }
+        }
+    }
+
+    impl BasePanel for Probe {
+        fn panel_name(&self) -> &'static str {
+            "Probe"
+        }
+    }
+
+    impl Panel for Probe {
+        fn title(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+            "Probe"
+        }
+    }
+
+    impl EventEmitter<PanelEvent> for Probe {}
+
+    impl Focusable for Probe {
+        fn focus_handle(&self, _: &App) -> FocusHandle {
+            self.focus_handle.clone()
+        }
+    }
+
+    impl Render for Probe {
+        fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
+            Empty
+        }
+    }
+
+    /// Base reserves only `gpui_base::dock::CLOSED_BOTTOM_STRIP` for a closed
+    /// bottom dock, so the tab bar drawn in place of one has to shrink to that
+    /// height; at the full title-bar height its bottom was clipped away.
+    #[gpui::test]
+    fn a_collapsed_bottom_dock_bar_fits_the_reserved_strip(cx: &mut TestAppContext) {
+        cx.update(|cx| {
+            gpui_component::init(cx);
+        });
+        let (area, cx) = cx.add_window_view(|window, cx| {
+            let skin = SignedDockSkin::new(cx);
+            DockArea::new("test", None, window, cx).with_renderer(skin)
+        });
+
+        cx.update(|window, cx| {
+            let center = cx.new(Probe::new);
+            let bottom = cx.new(Probe::new);
+            area.update(cx, |area, cx| {
+                area.set_center(
+                    DockLayout::tabs().panel_view(panel_handle(center), cx),
+                    window,
+                    cx,
+                );
+                area.set_dock(
+                    DockPlacement::Bottom,
+                    DockLayout::tabs().panel_view(panel_handle(bottom), cx),
+                    window,
+                    cx,
+                );
+            });
+        });
+        cx.run_until_parked();
+        cx.update(|window, cx| window.draw(cx).clear(cx));
+
+        // Open, nothing is collapsed, so no bar carries the selector.
+        assert!(cx.debug_bounds(COLLAPSED_TAB_BAR_SELECTOR).is_none());
+
+        cx.update(|window, cx| {
+            area.update(cx, |area, cx| {
+                area.toggle_dock(DockPlacement::Bottom, window, cx);
+            });
+        });
+        cx.run_until_parked();
+        cx.update(|window, cx| window.draw(cx).clear(cx));
+
+        let bounds = cx
+            .debug_bounds(COLLAPSED_TAB_BAR_SELECTOR)
+            .expect("a collapsed bottom dock draws its stand-in tab bar");
+        // `gpui_base::dock::CLOSED_BOTTOM_STRIP`, which the engine does not
+        // re-export. The bar used to be `TAB_BAR_HEIGHT` here and its bottom was
+        // clipped away; it now has to fit inside what base reserves.
+        let reserved_strip = px(29.);
+        assert!(
+            bounds.size.height <= reserved_strip,
+            "the collapsed bar is {}px tall, more than the {}px strip base reserves",
+            bounds.size.height,
+            reserved_strip,
+        );
+    }
+
+    #[test]
+    fn navigation_buttons_follow_the_setting_and_tab_count() {
+        // Hidden by default, no matter how many tabs there are.
+        assert!(!navigation_buttons_visible(true, 1));
+        assert!(!navigation_buttons_visible(true, 20));
+
+        // When not hidden they still only appear for a crowded strip.
+        assert!(!navigation_buttons_visible(false, 10));
+        assert!(navigation_buttons_visible(false, 11));
+    }
+}

crates/dock/src/tiles.rs

@@ -1,411 +0,0 @@
-//! The Signed appearance for a tiles canvas.
-//!
-//! `gpui_base::dock::TilesState` owns the geometry — snapping, the resize
-//! arithmetic, the undo stack, the zoom flag — and draws none of it. The tile
-//! frame, its title bar and its resize affordances are here, ported from
-//! gpui-component's `TilesSkin` (the vendored dock had no tiles canvas, so
-//! there is no local look to preserve).
-
-use std::rc::Rc;
-
-use gpui::prelude::FluentBuilder as _;
-use gpui::{
-    AnyElement, App, AppContext as _, Context, Div, DragMoveEvent, Empty, InteractiveElement as _,
-    IntoElement, MouseButton, MouseDownEvent, ParentElement as _, Pixels, Render, ScrollHandle,
-    Size, Stateful, StatefulInteractiveElement as _, Styled as _, Window, div, px,
-};
-use gpui_base::dock::{
-    DRAG_BAR_HEIGHT, HANDLE_SIZE, NodeId, ResizeSide, TileContext, TilesRenderer,
-};
-use gpui_component::button::{Button, ButtonVariants as _};
-use gpui_component::menu::{DropdownMenu as _, PopupMenuItem};
-use gpui_component::scroll::Scrollbar;
-use gpui_component::{
-    ActiveTheme as _, Icon, IconName, Selectable as _, Sizable as _, h_flex, v_flex,
-};
-
-use crate::dock_area::SkinShared;
-use crate::tab_panel::panel_title;
-use crate::{PanelHandle, t};
-
-/// How far a resize handle sticks out past the tile's edge.
-const HANDLE_OFFSET: Pixels = px(-4.);
-
-/// The payload a tile drag carries, so one canvas ignores another's drags.
-#[derive(Clone)]
-struct DragMoving(NodeId);
-
-impl Render for DragMoving {
-    fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
-        Empty
-    }
-}
-
-/// The payload a tile resize carries, for the same reason.
-#[derive(Clone)]
-struct DragResizing(NodeId);
-
-impl Render for DragResizing {
-    fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl IntoElement {
-        Empty
-    }
-}
-
-/// One tiles canvas's appearance.
-///
-/// Built per canvas — `DockAreaRenderer::tiles_renderer` is called once per
-/// container — so the scroll position belongs to the canvas it scrolls.
-pub(crate) struct SignedTilesSkin {
-    shared: Rc<SkinShared>,
-    scroll_handle: ScrollHandle,
-}
-
-impl SignedTilesSkin {
-    pub(crate) fn new(shared: Rc<SkinShared>) -> Self {
-        Self {
-            shared,
-            scroll_handle: ScrollHandle::default(),
-        }
-    }
-
-    /// One edge or corner handle.
-    fn resize_handle(
-        &self,
-        tile: &TileContext,
-        id: &'static str,
-        side: ResizeSide,
-        build: impl FnOnce(Stateful<Div>) -> Stateful<Div>,
-    ) -> Stateful<Div> {
-        let node = tile.node();
-
-        build(div().id(id).absolute())
-            .on_mouse_down(MouseButton::Left, {
-                let tile = tile.clone();
-                move |event: &MouseDownEvent, window, cx| {
-                    tile.begin_resize(side, event.position, window, cx);
-                    cx.stop_propagation();
-                }
-            })
-            .on_drag(DragResizing(node), |drag, _, _, cx| {
-                cx.stop_propagation();
-                cx.new(|_| drag.clone())
-            })
-            .on_drag_move({
-                let tile = tile.clone();
-                move |event: &DragMoveEvent<DragResizing>, window, cx| {
-                    if event.drag(cx).0 != node {
-                        return;
-                    }
-                    tile.resize_to(event.event.position, window, cx);
-                }
-            })
-    }
-
-    /// The trailing controls of a tile's title bar: zoom, close and the
-    /// ellipsis menu. They use click handlers rather than the
-    /// [`ToggleZoom`](crate::ToggleZoom)/[`ClosePanel`](crate::ClosePanel)
-    /// actions, which are dispatched to a focused tab group — a tile is
-    /// not one.
-    fn render_tile_controls(
-        &self,
-        tile: &TileContext,
-        window: &mut Window,
-        cx: &mut App,
-    ) -> impl IntoElement {
-        let handle = PanelHandle::of(tile.panel());
-        let control = handle.and_then(|handle| handle.zoom_control(cx));
-        let zoomed = tile.is_zoomed();
-        let toolbar_zoom =
-            tile.is_zoomable() && control.is_some_and(|control| control.toolbar_visible());
-        let menu_zoom = tile.is_zoomable() && control.is_some_and(|control| control.menu_visible());
-        let closable = tile.is_closable();
-        let buttons = handle.and_then(|handle| handle.toolbar_buttons(window, cx));
-        let panel = handle.map(|handle| handle.panel());
-
-        h_flex()
-            .gap_1()
-            .flex_shrink_0()
-            .occlude()
-            .when_some(buttons, |this, buttons| {
-                this.children(
-                    buttons
-                        .into_iter()
-                        .map(|button| button.xsmall().ghost().tab_stop(false)),
-                )
-            })
-            .when_some(
-                match (zoomed, toolbar_zoom) {
-                    (true, _) => Some(("zoom-out", IconName::Minimize, t("Dock.Zoom Out"))),
-                    (false, true) => Some(("zoom-in", IconName::Maximize, t("Dock.Zoom In"))),
-                    (false, false) => None,
-                },
-                |this, (id, icon, tooltip)| {
-                    this.child(
-                        Button::new(id)
-                            .icon(icon)
-                            .xsmall()
-                            .ghost()
-                            .tab_stop(false)
-                            .tooltip(tooltip)
-                            .selected(zoomed)
-                            .on_click({
-                                let tile = tile.clone();
-                                move |_, window, cx| tile.toggle_zoom(window, cx)
-                            }),
-                    )
-                },
-            )
-            .child(
-                Button::new("menu")
-                    .icon(IconName::Ellipsis)
-                    .xsmall()
-                    .ghost()
-                    .tab_stop(false)
-                    .dropdown_menu({
-                        let tile = tile.clone();
-                        move |menu, window, cx| {
-                            menu.when_some(panel.clone(), |menu, panel| {
-                                panel.dropdown_menu(menu, window, cx)
-                            })
-                            .separator()
-                            .item(
-                                PopupMenuItem::new(match zoomed {
-                                    true => t("Dock.Zoom Out"),
-                                    false => t("Dock.Zoom In"),
-                                })
-                                .disabled(!menu_zoom && !zoomed)
-                                .on_click({
-                                    let tile = tile.clone();
-                                    move |_, window, cx| tile.toggle_zoom(window, cx)
-                                }),
-                            )
-                            .when(closable, |menu| {
-                                menu.separator()
-                                    .item(PopupMenuItem::new(t("Dock.Close")).on_click({
-                                        let tile = tile.clone();
-                                        move |_, window, cx| tile.close(window, cx)
-                                    }))
-                            })
-                        }
-                    })
-                    .anchor(gpui::Anchor::TopRight),
-            )
-    }
-}
-
-impl TilesRenderer for SignedTilesSkin {
-    fn frame(&self, _: &mut Window, cx: &mut App) -> Stateful<Div> {
-        div()
-            .id("tiles")
-            .relative()
-            .size_full()
-            .bg(cx.theme().tokens.tiles)
-            .track_scroll(&self.scroll_handle)
-            .overflow_scroll()
-    }
-
-    fn tile_frame(&self, tile: &TileContext, _: &mut Window, cx: &mut App) -> Stateful<Div> {
-        v_flex()
-            .id(("tile", tile.panel_id().as_u64()))
-            .occlude()
-            .overflow_hidden()
-            .bg(cx.theme().tokens.background)
-            .border_1()
-            .border_color(cx.theme().border)
-            .rounded(cx.theme().tile_radius)
-            // Room for the title bar, which is positioned over the padding so
-            // the panel below it is never covered. Base draws the panel view
-            // as a plain child, so this is the only way to keep the two from
-            // overlapping.
-            .pt(DRAG_BAR_HEIGHT)
-            // Base installs the stored bounds on an ordinary tile and nothing
-            // at all on a zoomed one — how a zoomed tile fills the dock is
-            // this skin's decision.
-            .when(tile.is_zoomed(), |this| this.size_full())
-            .on_mouse_down(MouseButton::Left, {
-                let tile = tile.clone();
-                move |_, window, cx| tile.bring_to_front(window, cx)
-            })
-            // A gesture can end with the pointer anywhere, so both halves are
-            // needed; each is a no-op unless this tile is the one moving.
-            .on_mouse_up(MouseButton::Left, {
-                let tile = tile.clone();
-                move |_, window, cx| {
-                    tile.end_move(window, cx);
-                    tile.end_resize(window, cx);
-                }
-            })
-            .on_mouse_up_out(MouseButton::Left, {
-                let tile = tile.clone();
-                move |_, window, cx| {
-                    tile.end_move(window, cx);
-                    tile.end_resize(window, cx);
-                }
-            })
-    }
-
-    fn render_drag_bar(&self, tile: &TileContext, window: &mut Window, cx: &mut App) -> AnyElement {
-        let node = tile.node();
-        let handle = PanelHandle::of(tile.panel());
-        let title_style = handle.and_then(|handle| handle.title_style(cx));
-
-        h_flex()
-            .id("drag-bar")
-            .absolute()
-            .top_0()
-            .left_0()
-            .w_full()
-            .h(DRAG_BAR_HEIGHT)
-            .items_center()
-            .gap_1()
-            .pl_3()
-            .pr_2()
-            .when_some(title_style, |this, style| {
-                this.bg(style.background).text_color(style.foreground)
-            })
-            .child(
-                div()
-                    .flex_1()
-                    .min_w_16()
-                    .overflow_hidden()
-                    .text_ellipsis()
-                    .whitespace_nowrap()
-                    .child(panel_title(tile.panel(), window, cx)),
-            )
-            .children(handle.and_then(|handle| handle.title_suffix(window, cx)))
-            .child(self.render_tile_controls(tile, window, cx))
-            // A zoomed tile is not at its stored bounds, so there is nothing
-            // for a move to mean; base refuses the gesture too.
-            .when(!tile.is_zoomed(), |this| {
-                this.cursor_grab()
-                    .on_mouse_down(MouseButton::Left, {
-                        let tile = tile.clone();
-                        move |event: &MouseDownEvent, window, cx| {
-                            tile.begin_move(event.position, window, cx);
-                        }
-                    })
-                    .on_drag(DragMoving(node), |drag, _, _, cx| {
-                        cx.stop_propagation();
-                        cx.new(|_| drag.clone())
-                    })
-                    .on_drag_move({
-                        let tile = tile.clone();
-                        move |event: &DragMoveEvent<DragMoving>, window, cx| {
-                            if event.drag(cx).0 != node {
-                                return;
-                            }
-                            tile.move_to(event.event.position, window, cx);
-                        }
-                    })
-            })
-            .into_any_element()
-    }
-
-    fn render_resize_handles(
-        &self,
-        tile: &TileContext,
-        _: &mut Window,
-        cx: &mut App,
-    ) -> AnyElement {
-        let bounds = tile.bounds();
-
-        // A passive full-tile box so each handle is positioned against the
-        // tile rather than against whatever the flow put it next to. It
-        // registers no interaction of its own, so it does not shadow the panel
-        // underneath.
-        div()
-            .absolute()
-            .top_0()
-            .left_0()
-            .size_full()
-            .child(
-                self.resize_handle(tile, "left-resize-handle", ResizeSide::Left, |this| {
-                    this.cursor_ew_resize()
-                        .top_0()
-                        .left(HANDLE_OFFSET)
-                        .w(HANDLE_SIZE)
-                        .h(bounds.size.height)
-                }),
-            )
-            .child(
-                self.resize_handle(tile, "right-resize-handle", ResizeSide::Right, |this| {
-                    this.cursor_ew_resize()
-                        .top_0()
-                        .right(HANDLE_OFFSET)
-                        .w(HANDLE_SIZE)
-                        .h(bounds.size.height)
-                }),
-            )
-            .child(
-                self.resize_handle(tile, "top-resize-handle", ResizeSide::Top, |this| {
-                    this.cursor_ns_resize()
-                        .left_0()
-                        .top(HANDLE_OFFSET)
-                        .w(bounds.size.width)
-                        .h(HANDLE_SIZE)
-                }),
-            )
-            .child(
-                self.resize_handle(tile, "bottom-resize-handle", ResizeSide::Bottom, |this| {
-                    this.cursor_ns_resize()
-                        .left_0()
-                        .bottom(HANDLE_OFFSET)
-                        .w(bounds.size.width)
-                        .h(HANDLE_SIZE)
-                }),
-            )
-            .child(
-                Icon::new(IconName::ResizeCorner)
-                    .size_3()
-                    .absolute()
-                    .right(px(1.))
-                    .bottom(px(1.))
-                    .text_color(cx.theme().muted_foreground.opacity(0.5)),
-            )
-            .child(self.resize_handle(
-                tile,
-                "corner-resize-handle",
-                ResizeSide::BottomRight,
-                |this| {
-                    this.cursor_nwse_resize()
-                        .right(HANDLE_OFFSET)
-                        .bottom(HANDLE_OFFSET)
-                        .size_3()
-                },
-            ))
-            .into_any_element()
-    }
-
-    /// The panel of a tile gets `size_full` here; base draws the panel as a
-    /// plain child, so without it a panel that does not size itself has no
-    /// size.
-    fn panel_frame(&self, tile: &TileContext, _: &mut Window, _: &mut App) -> Stateful<Div> {
-        h_flex()
-            .id(("tile-panel", tile.panel_id().as_u64()))
-            .overflow_hidden()
-            .size_full()
-    }
-
-    /// The canvas scrollbar. It must be an overlay: the frame is the scroll
-    /// container and base appends the tiles after it, so a scrollbar placed
-    /// inside would paint and hit-test underneath every tile.
-    fn render_overlay(
-        &self,
-        content: Size<Pixels>,
-        _: &mut Window,
-        _: &mut App,
-    ) -> Option<AnyElement> {
-        Some(
-            Scrollbar::new(&self.scroll_handle)
-                .scroll_size(content)
-                .when_some(self.shared.tiles_scrollbar_mode(), |this, mode| {
-                    this.mode(mode)
-                })
-                .into_any_element(),
-        )
-    }
-
-    fn grid_size(&self, cx: &App) -> Pixels {
-        cx.theme().tile_grid_size
-    }
-}

crates/dock/src/window_controls.rs

@@ -7,7 +7,6 @@ use gpui_component::{ActiveTheme, Icon, IconName, Sizable as _, h_flex};
 
 use crate::TAB_BAR_HEIGHT;
 
-/// The standard width of a window control button.
 const CONTROL_WIDTH: f32 = 34.;
 
 #[derive(IntoElement, Clone)]
@@ -147,8 +146,7 @@ pub(crate) fn window_controls(window: &mut Window, cx: &mut App) -> impl IntoEle
         .items_center()
         .flex_shrink_0()
         .h_full()
-        // Like native windows apps, the controls span the title bar but never
-        // grow past the tab bar height.
+        // The controls span the title bar but never grow past the tab bar height.
         .when(cfg!(target_os = "windows"), |this| {
             this.max_h(TAB_BAR_HEIGHT)
         })

crates/dock/tests/render_smoke.rs

@@ -1,8 +1,3 @@
-//! Render-path smoke tests: the skin reads the dock area while rendering, and
-//! GPUI panics if an entity is read while it is leased (being updated). These
-//! pin that the first frame — docks, groups, tab bars — renders without
-//! tripping the lease check.
-
 use dock::{BasePanel, Panel, SignedDockSkin, panel_handle};
 use gpui::{
     App, AppContext, Context, Empty, EventEmitter, FocusHandle, Focusable, IntoElement, Render,
@@ -84,12 +79,10 @@ fn the_first_frame_renders_the_area_and_its_docks(cx: &mut TestAppContext) {
         });
     });
 
-    // The first frame walks every render hook — the dock frame, each group's
-    // tab bar, the toolbar — all of which read the dock area.
+    // The first frame walks every render hook, all of which read the dock area.
     cx.update(|window, cx| window.draw(cx).clear(cx));
 
-    // Emptying a dock leaves an empty group behind; its render must also be
-    // safe (and draw nothing).
+    // Emptying a dock leaves an empty group, its render must also be safe.
     cx.update(|window, cx| {
         area.update(cx, |area, cx| {
             area.remove_panel(bottom, window, cx);

crates/metadata/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "metadata"
+version.workspace = true
+edition.workspace = true
+publish.workspace = true
+
+[dependencies]
+signed_state = { path = "../signed_state" }
+utils = { path = "../utils" }
+
+nostr-sdk.workspace = true
+flume.workspace = true
+futures.workspace = true
+anyhow.workspace = true
+gpui.workspace = true
+log.workspace = true

crates/metadata/src/lib.rs

@@ -0,0 +1,9 @@
+mod profile;
+
+use gpui::{App, AppContext};
+pub use profile::{Profile, ProfileDirectory, ProfileEvent, ProfileStore};
+
+/// Initialize the global profile store.
+pub fn init(cx: &mut App) {
+    ProfileStore::set_global(cx.new(ProfileStore::new), cx);
+}

crates/metadata/src/profile.rs

@@ -0,0 +1,374 @@
+use std::cell::RefCell;
+use std::collections::{HashMap, HashSet};
+use std::time::{Duration, Instant};
+
+use flume::Sender;
+use gpui::{
+    App, AppContext, Context, Entity, EventEmitter, Global, SharedString, Subscription, Task,
+};
+use nostr_sdk::prelude::*;
+use signed_state::{Backend, BackendEvent, sync_bootstrap_only};
+use utils::shorten_pubkey;
+
+const BATCH_TIMEOUT: Duration = Duration::from_millis(500);
+const REQUEST_CHUNK: usize = 100;
+
+#[derive(Debug, Clone)]
+pub struct Profile {
+    public_key: PublicKey,
+    metadata: Metadata,
+}
+
+impl Profile {
+    pub fn new(public_key: PublicKey, metadata: Metadata) -> Self {
+        Self {
+            public_key,
+            metadata,
+        }
+    }
+
+    pub fn public_key(&self) -> PublicKey {
+        self.public_key
+    }
+
+    pub fn metadata(&self) -> &Metadata {
+        &self.metadata
+    }
+
+    // Falls back to `name`, then a shortened npub.
+    pub fn name(&self) -> SharedString {
+        if let Some(display_name) = self.metadata.display_name.as_ref()
+            && !display_name.is_empty()
+        {
+            return SharedString::from(display_name.trim().to_owned());
+        }
+
+        if let Some(name) = self.metadata.name.as_ref()
+            && !name.is_empty()
+        {
+            return SharedString::from(name.trim().to_owned());
+        }
+
+        SharedString::from(shorten_pubkey(self.public_key))
+    }
+
+    pub fn picture(&self) -> Option<SharedString> {
+        self.metadata
+            .picture
+            .as_ref()
+            .filter(|p| !p.is_empty())
+            .map(|p| SharedString::from(p.clone()))
+    }
+
+    /// The newest profile per author from metadata events.
+    fn latest_profiles(events: impl IntoIterator<Item = Event>) -> Vec<Self> {
+        let mut latest: HashMap<PublicKey, (Timestamp, Metadata)> = HashMap::new();
+
+        for event in events {
+            match latest.get(&event.pubkey) {
+                Some((created_at, _)) if *created_at >= event.created_at => {}
+                _ => {
+                    let metadata = Metadata::from_json(&event.content).unwrap_or_default();
+                    latest.insert(event.pubkey, (event.created_at, metadata));
+                }
+            }
+        }
+
+        latest
+            .into_iter()
+            .map(|(public_key, (_, metadata))| Profile::new(public_key, metadata))
+            .collect()
+    }
+}
+
+/// Metadata for these authors may have changed in the local database.
+#[derive(Debug, Clone)]
+pub enum ProfileEvent {
+    Updated(Vec<PublicKey>),
+}
+
+/// Batches metadata requests into relay syncs feeding the local database.
+pub struct ProfileStore {
+    in_flight: RefCell<HashSet<PublicKey>>,
+    sender: Sender<PublicKey>,
+    _task: Task<Result<(), anyhow::Error>>,
+    _subscription: Subscription,
+}
+
+struct GlobalProfileStore(Entity<ProfileStore>);
+
+impl Global for GlobalProfileStore {}
+
+impl EventEmitter<ProfileEvent> for ProfileStore {}
+
+impl ProfileStore {
+    pub(crate) fn global(cx: &App) -> Entity<Self> {
+        cx.global::<GlobalProfileStore>().0.clone()
+    }
+
+    pub(crate) fn set_global(entity: Entity<Self>, cx: &mut App) {
+        cx.set_global(GlobalProfileStore(entity));
+    }
+
+    pub(crate) fn new(cx: &mut Context<Self>) -> Self {
+        let backend = Backend::global(cx);
+        let client = backend.read(cx).client();
+
+        let (sender, receiver) = flume::unbounded::<PublicKey>();
+
+        let subscription = cx.subscribe(&backend, |this, _backend, event, cx| {
+            if let BackendEvent::ProfileUpdates(authors) = event {
+                this.emit_updated(authors.clone(), cx);
+            }
+        });
+
+        let task = cx.spawn(async move |this, cx| {
+            let mut batch: HashSet<PublicKey> = HashSet::new();
+
+            loop {
+                match receiver.recv_async().await {
+                    Ok(public_key) => {
+                        batch.insert(public_key);
+                    }
+                    Err(_) => return Ok(()),
+                }
+
+                // The channel has no async timeout, race the receive against a timer.
+                let deadline = Instant::now() + BATCH_TIMEOUT;
+
+                loop {
+                    let now = Instant::now();
+
+                    if now >= deadline {
+                        break;
+                    }
+
+                    let timer = cx.background_executor().timer(deadline - now);
+                    futures::pin_mut!(timer);
+
+                    let recv = receiver.recv_async();
+                    futures::pin_mut!(recv);
+
+                    match futures::future::select(recv, timer).await {
+                        futures::future::Either::Left((Ok(public_key), _)) => {
+                            batch.insert(public_key);
+                        }
+                        futures::future::Either::Left((Err(_), _)) => return Ok(()),
+                        futures::future::Either::Right(_) => break,
+                    }
+                }
+
+                let authors: Vec<PublicKey> = batch.drain().collect();
+
+                for chunk in authors.chunks(REQUEST_CHUNK) {
+                    let opts = SyncOptions::default();
+                    let filter = Filter::new()
+                        .kind(Kind::Metadata)
+                        .authors(chunk.iter().copied());
+
+                    if let Err(e) = sync_bootstrap_only(&client, filter, opts).await {
+                        log::warn!("profile fetch failed: {e}");
+                    }
+                }
+
+                // Emit even when the sync failed, the database may hold newer data.
+                this.update(cx, |this, cx| {
+                    this.emit_updated(authors, cx);
+                })?;
+            }
+        });
+
+        Self {
+            in_flight: RefCell::new(HashSet::new()),
+            sender,
+            _task: task,
+            _subscription: subscription,
+        }
+    }
+
+    /// Queue a batched relay sync for keys without one in flight.
+    pub fn fetch(&self, keys: impl IntoIterator<Item = PublicKey>) {
+        let mut queue = Vec::new();
+        {
+            let mut in_flight = self.in_flight.borrow_mut();
+
+            for key in keys {
+                if in_flight.insert(key) {
+                    queue.push(key);
+                }
+            }
+        }
+        for public_key in queue {
+            if let Err(e) = self.sender.send(public_key) {
+                log::warn!("failed to queue profile fetch: {e}");
+            }
+        }
+    }
+
+    // Releases the in-flight keys so future fetches can be queued again.
+    fn emit_updated(&mut self, authors: Vec<PublicKey>, cx: &mut Context<Self>) {
+        if authors.is_empty() {
+            return;
+        }
+
+        {
+            let mut in_flight = self.in_flight.borrow_mut();
+            for author in &authors {
+                in_flight.remove(author);
+            }
+        }
+
+        cx.emit(ProfileEvent::Updated(authors));
+    }
+}
+
+/// Profile cache bound to one panel or screen.
+pub struct ProfileDirectory {
+    profiles: HashMap<PublicKey, Profile>,
+    pending: RefCell<HashSet<PublicKey>>,
+    tasks: Vec<Task<()>>,
+    _subscriptions: Vec<Subscription>,
+}
+
+impl ProfileDirectory {
+    pub fn new(cx: &mut App) -> Entity<Self> {
+        let store = ProfileStore::global(cx);
+
+        cx.new(|cx| {
+            let subscription =
+                cx.subscribe(&store, |this: &mut Self, _store, event, cx| match event {
+                    ProfileEvent::Updated(authors) => this.refresh(authors, cx),
+                });
+
+            Self {
+                profiles: HashMap::new(),
+                pending: RefCell::new(HashSet::new()),
+                tasks: Vec::new(),
+                _subscriptions: vec![subscription],
+            }
+        })
+    }
+
+    /// Resolve keys from the local database, queue the rest for a relay sync.
+    pub fn track<K>(&mut self, keys: K, cx: &mut Context<Self>)
+    where
+        K: IntoIterator<Item = PublicKey>,
+    {
+        let missing: Vec<PublicKey> = keys
+            .into_iter()
+            .filter(|key| {
+                !self.profiles.contains_key(key)
+                    && !self.with_pending(|pending| pending.contains(key))
+            })
+            .collect();
+
+        if missing.is_empty() {
+            return;
+        }
+
+        self.load(missing, true, cx);
+    }
+
+    /// The profile for a key, or a placeholder that queues a relay sync.
+    pub fn profile(&self, public_key: &PublicKey, cx: &App) -> Profile {
+        if let Some(profile) = self.profiles.get(public_key) {
+            return profile.clone();
+        }
+
+        if self.with_pending(|pending| pending.insert(*public_key)) {
+            let store = ProfileStore::global(cx);
+            store.read(cx).fetch([*public_key]);
+        }
+
+        Profile::new(*public_key, Metadata::default())
+    }
+
+    /// Refreshes profiles for keys that are already tracked.
+    fn refresh(&mut self, authors: &[PublicKey], cx: &mut Context<Self>) {
+        let tracked: Vec<PublicKey> = authors
+            .iter()
+            .copied()
+            .filter(|key| {
+                self.profiles.contains_key(key)
+                    || self.with_pending(|pending| pending.contains(key))
+            })
+            .collect();
+
+        if tracked.is_empty() {
+            return;
+        }
+
+        self.load(tracked, false, cx);
+    }
+
+    /// Loads profiles from the local database, queueing a relay sync for any missing keys.
+    fn load(&mut self, keys: Vec<PublicKey>, queue_sync: bool, cx: &mut Context<Self>) {
+        // Accept events that arrive while the database query is running.
+        self.with_pending(|pending| {
+            pending.extend(keys.iter().copied());
+        });
+
+        let backend = Backend::global(cx);
+        let client = backend.read(cx).client();
+        let query_keys = keys.clone();
+
+        let work = cx.background_spawn(async move {
+            let authors = query_keys.iter().copied();
+            let filter = Filter::new().kind(Kind::Metadata).authors(authors);
+            let events = client.database().query(filter).await?;
+
+            Ok::<_, anyhow::Error>(Profile::latest_profiles(events))
+        });
+
+        self.tasks.push(cx.spawn(async move |this, cx| {
+            let loaded = work.await;
+
+            this.update(cx, |this, cx| {
+                let remaining = match loaded {
+                    Ok(profiles) => {
+                        let found: HashSet<PublicKey> =
+                            profiles.iter().map(Profile::public_key).collect();
+                        this.insert_loaded(profiles, cx);
+                        keys.into_iter()
+                            .filter(|key| !found.contains(key))
+                            .collect()
+                    }
+                    Err(e) => {
+                        log::warn!("failed to load profiles from the database: {e}");
+                        keys
+                    }
+                };
+
+                if queue_sync && !remaining.is_empty() {
+                    let store = ProfileStore::global(cx);
+                    store.read(cx).fetch(remaining);
+                }
+            })
+            .ok();
+        }));
+    }
+
+    // Inserts database results, replacing anything loaded earlier.
+    fn insert_loaded(&mut self, profiles: Vec<Profile>, cx: &mut Context<Self>) {
+        let mut inserted = false;
+
+        for profile in profiles {
+            let public_key = profile.public_key();
+            self.profiles.insert(public_key, profile);
+            self.with_pending(|pending| pending.remove(&public_key));
+            inserted = true;
+        }
+
+        if inserted {
+            cx.notify();
+        }
+    }
+
+    fn with_pending<R, T>(&self, then: T) -> R
+    where
+        T: FnOnce(&mut HashSet<PublicKey>) -> R,
+    {
+        let mut pending = self.pending.borrow_mut();
+        then(&mut pending)
+    }
+}

crates/paths/src/lib.rs

@@ -1,23 +1,16 @@
-//! Paths to locations used by Signed.
-//!
-//! Follows the same pattern as Zed's `paths` crate: platform-correct base
-//! directories, resolved once and cached, with an optional custom data dir
-//! override for portable/dev installs.
-
 use std::path::PathBuf;
 use std::sync::OnceLock;
 
-/// The application name, used to derive platform-specific data, config and
-/// cache directory paths.
+/// The application name.
+///
+/// It derives the platform-specific data, config and cache directory paths.
 pub const APP_NAME: &str = "Signed";
 
-/// Lowercased form of [`APP_NAME`], for use in XDG-style paths on
-/// Linux/FreeBSD and the macOS `~/.config` fallback.
+/// Lowercased form of [`APP_NAME`].
+///
+/// Used in XDG-style paths on Linux and FreeBSD, and the macOS `~/.config` fallback.
 pub const APP_NAME_LOWERCASE: &str = "signed";
 
-/// A custom data directory override, set only by [`set_custom_data_dir`].
-static CUSTOM_DATA_DIR: OnceLock<PathBuf> = OnceLock::new();
-
 /// The resolved data directory.
 /// On macOS, this is `~/Library/Application Support/Signed`.
 /// On Linux/FreeBSD, this is `$XDG_DATA_HOME/signed`.
@@ -30,50 +23,27 @@ static CURRENT_DATA_DIR: OnceLock<PathBuf> = OnceLock::new();
 /// On Windows, this is `%APPDATA%\Signed`.
 static CONFIG_DIR: OnceLock<PathBuf> = OnceLock::new();
 
-/// Returns the current user's home directory.
-pub fn home_dir() -> PathBuf {
+fn home_dir() -> PathBuf {
     dirs::home_dir().expect("failed to determine home directory")
 }
 
-/// Returns the current user's Desktop folder, falling back to the home
-/// directory (or an empty path) when it can't be determined.
+/// Returns the current user's Desktop folder.
+///
+/// Falls back to the home directory or an empty path when it cannot be determined.
 pub fn desktop_dir() -> PathBuf {
     dirs::desktop_dir().unwrap_or_else(|| dirs::home_dir().unwrap_or_default())
 }
 
-/// Returns the current user's Documents folder, falling back to the home
-/// directory (or an empty path) when it can't be determined.
+/// Returns the current user's Documents folder.
+///
+/// Falls back to the home directory or an empty path when it cannot be determined.
 pub fn documents_dir() -> PathBuf {
     dirs::document_dir().unwrap_or_else(|| dirs::home_dir().unwrap_or_default())
 }
 
-/// Sets a custom directory for all user data, overriding the default data
-/// directory. Must be called before any other path operation. The directory
-/// is created if it doesn't exist and canonicalized to an absolute path.
-///
-/// # Panics
-///
-/// Panics if called after [`data_dir`] or [`config_dir`] was initialized, or
-/// if the directory cannot be created/canonicalized.
-pub fn set_custom_data_dir(dir: &str) -> &'static PathBuf {
-    if CURRENT_DATA_DIR.get().is_some() || CONFIG_DIR.get().is_some() {
-        panic!("set_custom_data_dir called after data_dir or config_dir was initialized");
-    }
-
-    CUSTOM_DATA_DIR.get_or_init(|| {
-        let path = PathBuf::from(dir);
-        std::fs::create_dir_all(&path).expect("failed to create custom data directory");
-        path.canonicalize()
-            .expect("failed to canonicalize custom data directory")
-    })
-}
-
-/// Returns the path to the configuration directory.
-pub fn config_dir() -> &'static PathBuf {
+fn config_dir() -> &'static PathBuf {
     CONFIG_DIR.get_or_init(|| {
-        if let Some(custom_dir) = CUSTOM_DATA_DIR.get() {
-            custom_dir.join("config")
-        } else if cfg!(target_os = "windows") {
+        if cfg!(target_os = "windows") {
             dirs::config_dir()
                 .expect("failed to determine RoamingAppData directory")
                 .join(APP_NAME)
@@ -90,12 +60,9 @@ pub fn config_dir() -> &'static PathBuf {
     })
 }
 
-/// Returns the path to the data directory.
-pub fn data_dir() -> &'static PathBuf {
+fn data_dir() -> &'static PathBuf {
     CURRENT_DATA_DIR.get_or_init(|| {
-        if let Some(custom_dir) = CUSTOM_DATA_DIR.get() {
-            custom_dir.clone()
-        } else if cfg!(target_os = "macos") {
+        if cfg!(target_os = "macos") {
             home_dir()
                 .join("Library/Application Support")
                 .join(APP_NAME)
@@ -116,63 +83,23 @@ pub fn data_dir() -> &'static PathBuf {
     })
 }
 
-/// Returns the path to the cache directory.
-pub fn cache_dir() -> &'static PathBuf {
-    static CACHE_DIR: OnceLock<PathBuf> = OnceLock::new();
-    CACHE_DIR.get_or_init(|| {
-        if cfg!(target_os = "macos") {
-            dirs::cache_dir()
-                .expect("failed to determine caches directory")
-                .join(APP_NAME)
-        } else if cfg!(target_os = "windows") {
-            dirs::cache_dir()
-                .expect("failed to determine LocalAppData directory")
-                .join(APP_NAME)
-        } else if cfg!(any(target_os = "linux", target_os = "freebsd")) {
-            if let Ok(flatpak_xdg_cache) = std::env::var("FLATPAK_XDG_CACHE_HOME") {
-                flatpak_xdg_cache.into()
-            } else {
-                dirs::cache_dir().expect("failed to determine XDG_CACHE_HOME directory")
-            }
-            .join(APP_NAME_LOWERCASE)
-        } else {
-            home_dir().join(".cache").join(APP_NAME_LOWERCASE)
-        }
-    })
-}
-
-/// Returns the path to the logs directory.
-pub fn logs_dir() -> &'static PathBuf {
-    static LOGS_DIR: OnceLock<PathBuf> = OnceLock::new();
-    LOGS_DIR.get_or_init(|| {
-        if cfg!(target_os = "macos") {
-            home_dir().join("Library/Logs").join(APP_NAME)
-        } else {
-            data_dir().join("logs")
-        }
-    })
-}
-
-/// Returns the path to the nostr database directory (LMDB).
+/// Returns the path to the nostr database directory, LMDB.
 pub fn nostr_dir() -> &'static PathBuf {
     static NOSTR_DIR: OnceLock<PathBuf> = OnceLock::new();
     NOSTR_DIR.get_or_init(|| data_dir().join("nostr"))
 }
 
-/// Returns the path to the local git clone cache (grasp mirrors).
+/// Returns the path to the local git clone cache, the grasp mirrors.
+///
+/// The mirrors are disposable and re-cloned from their grasp server on
+/// demand, so the cache lives in the OS temp directory for the system to
+/// reclaim.
 pub fn repos_dir() -> &'static PathBuf {
     static REPOS_DIR: OnceLock<PathBuf> = OnceLock::new();
-    REPOS_DIR.get_or_init(|| data_dir().join("repos"))
+    REPOS_DIR.get_or_init(|| std::env::temp_dir().join(APP_NAME_LOWERCASE).join("repos"))
 }
 
-/// Returns the path to the `settings.json` file.
 pub fn settings_file() -> &'static PathBuf {
     static SETTINGS_FILE: OnceLock<PathBuf> = OnceLock::new();
     SETTINGS_FILE.get_or_init(|| config_dir().join("settings.json"))
 }
-
-/// Returns the path to the `keymap.json` file.
-pub fn keymap_file() -> &'static PathBuf {
-    static KEYMAP_FILE: OnceLock<PathBuf> = OnceLock::new();
-    KEYMAP_FILE.get_or_init(|| config_dir().join("keymap.json"))
-}

crates/settings/src/lib.rs

@@ -1,9 +1,3 @@
-//! Persisted application settings for Signed.
-//!
-//! The [`Settings`] model holds the user-configurable values that survive
-//! restarts, and [`SettingsStore`] loads them from and saves them to a JSON
-//! file on disk (see [`paths::settings_file`]).
-
 mod settings;
 mod store;
 

crates/settings/src/settings.rs

@@ -2,33 +2,32 @@ use std::path::PathBuf;
 
 use serde::{Deserialize, Serialize};
 
-/// The default grasp servers offered when the user hasn't published a
-/// grasp list (kind `10317`) yet.
+/// The default grasp servers, offered while the user has not published a grasp list.
 pub const DEFAULT_GRASP_SERVERS: [&str; 3] = [
     "wss://relay.ngit.dev",
     "wss://gitnostr.com",
     "wss://git.shakespeare.diy",
 ];
 
-/// How the application picks its appearance.
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum AppearanceMode {
-    /// Follow the system appearance (light/dark) at runtime.
     #[default]
     System,
-    /// Always use the light theme.
     Light,
-    /// Always use the dark theme.
     Dark,
 }
 
-/// Theme configuration.
-///
-/// The fields mirror the gpui-component `Theme` surface the application
-/// customizes at startup, so applying the settings is a plain field-for-field
-/// copy. The theme names identify entries in the gpui-component theme
-/// registry.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EventFetchingStrategy {
+    /// Only the relays declared in the repository announcement.
+    Curated,
+    /// Repository relays plus every maintainer's NIP-65 relays.
+    #[default]
+    Uncensored,
+}
+
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
 pub struct ThemeSettings {
@@ -42,11 +41,11 @@ pub struct ThemeSettings {
     pub mono_font_size: f32,
     /// Corner radius for general elements in pixels.
     pub radius: f32,
-    /// Corner radius for large elements (dialogs, notifications) in pixels.
+    /// Corner radius for large elements, dialogs and notifications, in pixels.
     pub radius_lg: f32,
     /// Whether focused controls draw a ring outside their border.
     pub focus_ring: bool,
-    /// Whether to render shadows.
+    /// Whether to apply a shadow to elements.
     pub shadow: bool,
 }
 
@@ -57,20 +56,34 @@ impl Default for ThemeSettings {
             dark_theme: "Signed Dark".into(),
             font_size: 16.0,
             mono_font_size: 13.0,
-            radius: 2.0,
-            radius_lg: 6.0,
+            radius: 4.0,
+            radius_lg: 8.0,
             focus_ring: false,
             shadow: false,
         }
     }
 }
 
-/// Default grasp server settings.
+/// Tab bar chrome.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct TabBarSettings {
+    /// Hide the previous and next tab buttons.
+    pub hide_navigation_buttons: bool,
+}
+
+impl Default for TabBarSettings {
+    fn default() -> Self {
+        Self {
+            hide_navigation_buttons: true,
+        }
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
 pub struct GraspServersSettings {
-    /// The servers offered when the user hasn't published a grasp list
-    /// (kind `10317`) yet.
+    /// Servers offered while the user has not published a grasp list, kind `10317`.
     pub default_servers: Vec<String>,
 }
 
@@ -85,34 +98,50 @@ impl Default for GraspServersSettings {
     }
 }
 
-/// Local repository scanning.
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
 pub struct LocalReposSettings {
-    /// The directories scanned for local git repositories.
+    /// The directories scanned for local git repositories,
+    /// Defaults:
     ///
-    /// Defaults to the user's Desktop and Documents folders.
+    /// - `~/Desktop`
+    /// - `~/Documents`
     pub scan_paths: Vec<PathBuf>,
 }
 
-fn default_scan_paths() -> Vec<PathBuf> {
-    vec![paths::desktop_dir(), paths::documents_dir()]
-}
-
 impl Default for LocalReposSettings {
     fn default() -> Self {
         Self {
-            scan_paths: default_scan_paths(),
+            scan_paths: vec![paths::desktop_dir(), paths::documents_dir()],
         }
     }
 }
 
-/// The create-repository dialog.
+/// A remembered association between a local checkout folder and an announced repository,
+/// recorded when the user clones a repository or picks a folder in the New PR panel.
+///
+/// The panel can then prefill the folder later without asking again.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
+#[serde(default)]
+pub struct CheckoutRecord {
+    pub path: PathBuf,
+    /// Repository address as a string, `30617:<pubkey>:<id>`.
+    pub addr: String,
+    /// Unix seconds of the last use, for freshest-first ordering.
+    pub last_used: u64,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct CheckoutsSettings {
+    /// The latest use of a path and repo pair replaces the older record.
+    pub records: Vec<CheckoutRecord>,
+}
+
 #[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
 pub struct CreateRepositorySettings {
-    /// The folder the create-repository dialog defaults to; the user's
-    /// Desktop when unset.
+    /// The folder the create-repository dialog defaults to, the user's Desktop when unset.
     pub default_folder: Option<PathBuf>,
 }
 
@@ -120,15 +149,13 @@ pub struct CreateRepositorySettings {
 #[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
 pub struct Settings {
-    /// How the application picks its appearance.
     pub appearance: AppearanceMode,
-    /// Theme configuration.
+    pub event_fetching: EventFetchingStrategy,
     pub theme: ThemeSettings,
-    /// Default grasp servers.
+    pub tab_bar: TabBarSettings,
     pub grasp_servers: GraspServersSettings,
-    /// Local repository scanning.
     pub local_repos: LocalReposSettings,
-    /// The create-repository dialog.
+    pub checkouts: CheckoutsSettings,
     pub create_repository: CreateRepositorySettings,
 }
 
@@ -136,34 +163,11 @@ pub struct Settings {
 mod tests {
     use super::*;
 
-    #[test]
-    fn defaults_match_the_app_conventions() {
-        let settings = Settings::default();
-        assert_eq!(settings.appearance, AppearanceMode::System);
-        assert_eq!(settings.theme.light_theme, "Signed Light");
-        assert_eq!(settings.theme.dark_theme, "Signed Dark");
-        assert_eq!(settings.theme.font_size, 16.0);
-        assert_eq!(settings.theme.mono_font_size, 13.0);
-        assert_eq!(settings.theme.radius, 2.0);
-        assert_eq!(settings.theme.radius_lg, 6.0);
-        assert!(!settings.theme.focus_ring);
-        assert!(!settings.theme.shadow);
-        assert_eq!(
-            settings.grasp_servers.default_servers,
-            DEFAULT_GRASP_SERVERS.map(String::from).to_vec()
-        );
-        assert_eq!(settings.local_repos.scan_paths.len(), 2);
-        assert_eq!(
-            settings.local_repos.scan_paths,
-            vec![paths::desktop_dir(), paths::documents_dir()]
-        );
-        assert_eq!(settings.create_repository.default_folder, None);
-    }
-
     #[test]
     fn json_roundtrip_preserves_everything() {
         let settings = Settings {
             appearance: AppearanceMode::Dark,
+            event_fetching: EventFetchingStrategy::Curated,
             theme: ThemeSettings {
                 radius: 8.0,
                 ..Default::default()
@@ -179,18 +183,14 @@ mod tests {
         assert_eq!(parsed, settings);
     }
 
-    #[test]
-    fn missing_keys_fall_back_to_defaults() {
-        let settings: Settings = serde_json::from_str("{}").unwrap();
-        assert_eq!(settings, Settings::default());
-    }
-
     #[test]
     fn partial_json_merges_with_defaults() {
         let settings: Settings =
             serde_json::from_str(r#"{"appearance": "dark", "theme": {"radius": 4.0}}"#).unwrap();
         assert_eq!(settings.appearance, AppearanceMode::Dark);
         assert_eq!(settings.theme.radius, 4.0);
+        // Unset fields fall back to their defaults, including the fetching strategy.
+        assert_eq!(settings.event_fetching, EventFetchingStrategy::Uncensored);
         // The rest of the theme and the other groups keep their defaults.
         assert_eq!(settings.theme.light_theme, "Signed Light");
         assert_eq!(settings.grasp_servers, GraspServersSettings::default());
@@ -198,18 +198,10 @@ mod tests {
     }
 
     #[test]
-    fn appearance_serializes_to_snake_case_names() {
-        assert_eq!(
-            serde_json::to_string(&AppearanceMode::System).unwrap(),
-            "\"system\""
-        );
-        assert_eq!(
-            serde_json::to_string(&AppearanceMode::Light).unwrap(),
-            "\"light\""
-        );
-        assert_eq!(
-            serde_json::to_string(&AppearanceMode::Dark).unwrap(),
-            "\"dark\""
-        );
+    fn event_fetching_uses_snake_case() {
+        let json = serde_json::to_string(&EventFetchingStrategy::Curated).unwrap();
+        assert_eq!(json, r#""curated""#);
+        let parsed: EventFetchingStrategy = serde_json::from_str(r#""uncensored""#).unwrap();
+        assert_eq!(parsed, EventFetchingStrategy::Uncensored);
     }
 }

crates/settings/src/store.rs

@@ -9,7 +9,9 @@ struct GlobalSettingsStore(Entity<SettingsStore>);
 
 impl Global for GlobalSettingsStore {}
 
-/// The application settings, loaded from disk at startup and persisted whenever they change.
+/// The application settings,
+/// loaded from disk at startup and saved whenever they change.
+///
 /// Installed as a global by the app so any part of the UI can read and edit them.
 pub struct SettingsStore {
     path: PathBuf,
@@ -17,19 +19,26 @@ pub struct SettingsStore {
 }
 
 impl SettingsStore {
-    /// Retrieve the global settings store (created at startup by the app).
+    /// Retrieve the global settings store, created at startup by the app.
     pub fn global(cx: &App) -> Entity<Self> {
         cx.global::<GlobalSettingsStore>().0.clone()
     }
 
-    /// Install the store as a global.
+    /// Retrieve the global settings store if one has been installed.
+    pub fn try_global(cx: &App) -> Option<Entity<Self>> {
+        cx.try_global::<GlobalSettingsStore>()
+            .map(|store| store.0.clone())
+    }
+
     pub fn set_global(entity: Entity<Self>, cx: &mut App) {
         cx.set_global(GlobalSettingsStore(entity));
     }
 
-    /// Load the settings from `path`, falling back to the defaults when the
-    /// file is missing or unreadable. Missing keys merge with the defaults,
-    /// so older settings files keep working as new settings are added.
+    /// Load the settings from `path`,
+    /// falls back to defaults when the file is missing or unreadable.
+    ///
+    /// Missing keys merge with the defaults,
+    /// older settings files keep working as new settings are added.
     pub fn new(path: impl AsRef<Path>, _cx: &mut Context<Self>) -> Self {
         Self {
             path: path.as_ref().to_path_buf(),
@@ -78,8 +87,7 @@ impl SettingsStore {
         }
     }
 
-    /// Write the settings to disk, replacing the file atomically
-    /// so a crash mid-write cannot corrupt the settings.
+    /// Write the settings to disk, replacing the file atomically.
     fn save(&self) -> Result<()> {
         if let Some(parent) = self.path.parent() {
             std::fs::create_dir_all(parent)?;
@@ -100,8 +108,6 @@ impl SettingsStore {
 mod tests {
     use std::sync::atomic::{AtomicUsize, Ordering};
 
-    use gpui::{AppContext, TestAppContext};
-
     use super::*;
 
     static TEST_FILE_COUNTER: AtomicUsize = AtomicUsize::new(0);
@@ -130,16 +136,6 @@ mod tests {
         cleanup(&path);
     }
 
-    #[test]
-    fn corrupt_file_loads_defaults() {
-        let path = temp_settings_path();
-        std::fs::write(&path, "{ not json").unwrap();
-
-        let settings = SettingsStore::load(&path);
-        assert_eq!(settings, Settings::default());
-        cleanup(&path);
-    }
-
     #[test]
     fn save_and_load_roundtrip() {
         let path = temp_settings_path();
@@ -157,21 +153,4 @@ mod tests {
         assert_eq!(SettingsStore::load(&path), expected);
         cleanup(&path);
     }
-
-    #[gpui::test]
-    fn edit_mutates_and_persists(cx: &mut TestAppContext) {
-        let path = temp_settings_path();
-        cleanup(&path);
-
-        let store = cx.update(|cx| cx.new(|cx| SettingsStore::new(path.clone(), cx)));
-        cx.read(|cx| assert_eq!(store.read(cx).settings(), &Settings::default()));
-
-        store.update(cx, |store, cx| {
-            store.edit(|settings| settings.theme.radius = 12.0, cx);
-        });
-
-        cx.read(|cx| assert_eq!(store.read(cx).settings().theme.radius, 12.0));
-        assert_eq!(SettingsStore::load(&path).theme.radius, 12.0);
-        cleanup(&path);
-    }
 }

crates/signed_core/Cargo.toml

@@ -5,5 +5,6 @@ edition.workspace = true
 publish.workspace = true
 
 [dependencies]
-gpui.workspace = true
 nostr.workspace = true
+serde.workspace = true
+utils = { path = "../utils" }

crates/signed_core/src/addr.rs

@@ -1,39 +1,98 @@
+use std::fmt;
+use std::str::FromStr;
+
 use nostr::prelude::*;
+use serde::{Deserialize, Serialize};
 
-/// Address of a NIP-34 repository announcement: `30617:<owner-pubkey>:<repo-id>`.
-///
-/// The Rust Nostr SDK's [`Coordinate`] already provides parsing, formatting and hashing for this.
-/// The alias keeps the repository-specific vocabulary while reusing the SDK type.
-pub type RepoAddr = Coordinate;
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct RepoAddr(Coordinate);
 
-/// Build the address of a NIP-34 repository announcement.
-pub fn repo_addr(owner: PublicKey, id: impl Into<String>) -> RepoAddr {
-    Coordinate::new(Kind::GitRepoAnnouncement, owner).identifier(id)
-}
+impl RepoAddr {
+    pub fn new(owner: PublicKey, identifier: impl Into<String>) -> Self {
+        Self(Coordinate::new(Kind::GitRepoAnnouncement, owner).identifier(identifier))
+    }
 
-/// Derive a repository identifier from a display name
-pub fn identifier_from_name(name: &str) -> String {
-    name.chars()
-        .map(|c| {
-            if c.is_ascii_alphanumeric() || c == '/' {
-                c
-            } else {
-                '-'
-            }
-        })
-        .collect()
-}
+    pub fn identifier_from_name(name: &str) -> String {
+        name.chars()
+            .map(|c| {
+                if c.is_ascii_alphanumeric() || c == '/' {
+                    c
+                } else {
+                    '-'
+                }
+            })
+            .collect()
+    }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
+    pub fn kind(&self) -> Kind {
+        self.0.kind
+    }
 
-    #[test]
-    fn identifier_from_name_slugs_like_gitworkshop() {
-        assert_eq!(identifier_from_name("My Repo"), "My-Repo");
-        assert_eq!(identifier_from_name("my-repo"), "my-repo");
-        assert_eq!(identifier_from_name("Foo_Bar!"), "Foo-Bar-");
-        assert_eq!(identifier_from_name("a/b"), "a/b");
-        assert_eq!(identifier_from_name("Café"), "Caf-");
+    pub fn public_key(&self) -> PublicKey {
+        self.0.public_key
+    }
+
+    pub fn identifier(&self) -> &str {
+        &self.0.identifier
+    }
+
+    pub fn coordinate(&self) -> &Coordinate {
+        &self.0
+    }
+
+    pub fn announcement_filter(&self) -> Filter {
+        Filter::new()
+            .kind(Kind::GitRepoAnnouncement)
+            .author(self.public_key())
+            .identifier(self.identifier())
+    }
+
+    pub fn state_filter(&self) -> Filter {
+        Filter::new()
+            .kind(Kind::RepoState)
+            .author(self.public_key())
+            .identifier(self.identifier())
+    }
+
+    pub fn activity_filter(&self) -> Filter {
+        Filter::new()
+            .kinds(crate::filters::ACTIVITY_KINDS)
+            .coordinate(&self.0)
+    }
+
+    pub fn deletion_filters(&self) -> Vec<Filter> {
+        vec![
+            Filter::new()
+                .kinds([Kind::EventDeletion, Kind::RequestToVanish])
+                .author(self.public_key()),
+            Filter::new().kind(Kind::EventDeletion).coordinate(&self.0),
+        ]
+    }
+}
+
+impl fmt::Display for RepoAddr {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(&self.0, f)
+    }
+}
+
+impl FromStr for RepoAddr {
+    type Err = <Coordinate as FromStr>::Err;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Coordinate::from_str(s).map(RepoAddr)
+    }
+}
+
+impl From<Coordinate> for RepoAddr {
+    fn from(coordinate: Coordinate) -> Self {
+        RepoAddr(coordinate)
+    }
+}
+
+impl From<RepoAddr> for Coordinate {
+    fn from(addr: RepoAddr) -> Self {
+        addr.0
     }
 }

crates/signed_core/src/annotations.rs

@@ -1,306 +0,0 @@
-use nostr::prelude::*;
-
-/// ngit / GitWorkshop cover-note extension (kind 1624): a markdown note
-/// attached to an issue, patch or PR by its author or a repository
-/// maintainer. Not part of the NIP-34 draft; read support for interop.
-pub const COVER_NOTE_KIND: Kind = Kind::Custom(1624);
-
-/// Whether a kind-1985 label event is a valid annotation of `root`: it
-/// references the root via a lowercase `e` tag and was authored by the root
-/// author or a maintainer.
-fn label_targets_root(event: &Event, root: &Event, maintainers: &[PublicKey]) -> bool {
-    if event.kind != Kind::Label {
-        return false;
-    }
-    if event.pubkey != root.pubkey && !maintainers.contains(&event.pubkey) {
-        return false;
-    }
-    let root_id = root.id.to_hex();
-    event
-        .tags
-        .iter()
-        .any(|tag| tag.kind() == "e" && tag.content().is_some_and(|content| content == root_id))
-}
-
-/// Whether a kind-1985 label event declares the `#t` namespace and carries at
-/// least one `["l", "<value>", "#t"]` label.
-fn has_hashtag_labels(event: &Event) -> bool {
-    event.tags.iter().any(|tag| tag.as_slice() == ["L", "#t"])
-        && event.tags.iter().any(|tag| {
-            let slice = tag.as_slice();
-            slice.len() >= 3 && slice[0] == "l" && slice[2] == "#t" && !slice[1].is_empty()
-        })
-}
-
-/// The effective hashtag labels of `root`: the `t` tags on the event itself
-/// (self-reported by its author) plus all labels attached via authorized
-/// NIP-32 kind-1985 events in the `#t` namespace. Labels are additive — all
-/// valid label events contribute (no latest-wins semantics).
-pub fn labels(root: &Event, label_events: &[Event], maintainers: &[PublicKey]) -> Vec<String> {
-    let mut labels: Vec<String> = root
-        .tags
-        .hashtags()
-        .map(|hashtag| hashtag.to_string())
-        .collect();
-
-    for event in label_events {
-        if !label_targets_root(event, root, maintainers) || !has_hashtag_labels(event) {
-            continue;
-        }
-        for tag in event.tags.iter() {
-            let slice = tag.as_slice();
-            if slice.len() >= 3 && slice[0] == "l" && slice[2] == "#t" && !slice[1].is_empty() {
-                let label = &slice[1];
-                if !labels.contains(label) {
-                    labels.push(label.clone());
-                }
-            }
-        }
-    }
-
-    labels
-}
-
-/// The effective subject/title override of `root`, from authorized kind-1985
-/// label events in the `#subject` namespace. Only the latest event wins
-/// (tiebreak: lexicographically larger event id, per NIP-01 replaceable
-/// semantics). Returns `None` when no valid override exists.
-pub fn subject_override(
-    root: &Event,
-    label_events: &[Event],
-    maintainers: &[PublicKey],
-) -> Option<String> {
-    label_events
-        .iter()
-        .filter(|event| label_targets_root(event, root, maintainers))
-        .filter(|event| {
-            event
-                .tags
-                .iter()
-                .any(|tag| tag.as_slice() == ["L", "#subject"])
-                && event.tags.iter().any(|tag| {
-                    let slice = tag.as_slice();
-                    slice.len() >= 3
-                        && slice[0] == "l"
-                        && slice[2] == "#subject"
-                        && !slice[1].is_empty()
-                })
-        })
-        .max_by(|a, b| {
-            a.created_at
-                .cmp(&b.created_at)
-                .then_with(|| a.id.to_string().cmp(&b.id.to_string()))
-        })
-        .and_then(|event| {
-            event.tags.iter().find_map(|tag| {
-                let slice = tag.as_slice();
-                (slice.len() >= 3
-                    && slice[0] == "l"
-                    && slice[2] == "#subject"
-                    && !slice[1].is_empty())
-                .then(|| slice[1].clone())
-            })
-        })
-}
-
-/// The effective hashtag labels and subject override of `root` in one pass
-/// (mirrors ngit's `get_labels_and_subject`).
-pub fn labels_and_subject(
-    root: &Event,
-    label_events: &[Event],
-    maintainers: &[PublicKey],
-) -> (Vec<String>, Option<String>) {
-    (
-        labels(root, label_events, maintainers),
-        subject_override(root, label_events, maintainers),
-    )
-}
-
-/// The effective cover note of `root`: the latest authorized kind-1624 event
-/// (tiebreak: lexicographically larger event id, per NIP-01 replaceable
-/// semantics). Returns `None` when no valid cover note exists.
-pub fn cover_note<'a>(
-    root: &Event,
-    cover_notes: &'a [Event],
-    maintainers: &[PublicKey],
-) -> Option<&'a Event> {
-    let root_id = root.id.to_hex();
-
-    cover_notes
-        .iter()
-        .filter(|event| {
-            event.kind == COVER_NOTE_KIND
-                && (event.pubkey == root.pubkey || maintainers.contains(&event.pubkey))
-                && event.tags.iter().any(|tag| {
-                    tag.kind() == "e" && tag.content().is_some_and(|content| content == root_id)
-                })
-        })
-        .max_by(|a, b| {
-            a.created_at
-                .cmp(&b.created_at)
-                .then_with(|| a.id.to_string().cmp(&b.id.to_string()))
-        })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn keys_from_hex(hex: &str) -> Keys {
-        Keys::new(SecretKey::from_hex(hex).expect("valid secret key"))
-    }
-
-    fn signed(author: &Keys, kind: Kind, tags: Vec<Tag>, created_at: u64) -> Event {
-        EventBuilder::new(kind, "")
-            .tags(tags)
-            .custom_created_at(Timestamp::from(created_at))
-            .finalize(author)
-            .expect("signed event")
-    }
-
-    fn root_event() -> Event {
-        signed(
-            &keys_from_hex("0000000000000000000000000000000000000000000000000000000000000001"),
-            Kind::GitIssue,
-            vec![Tag::hashtag("bug")],
-            100,
-        )
-    }
-
-    fn e_tag(event: &Event) -> Tag {
-        Tag::parse(["e", &event.id.to_hex()]).expect("valid e tag")
-    }
-
-    #[test]
-    fn labels_take_inline_hashtags_and_external_label_events() {
-        let root = root_event();
-        let maintainer =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000002");
-        let labels_event = signed(
-            &maintainer,
-            Kind::Label,
-            vec![
-                e_tag(&root),
-                Tag::parse(["L", "#t"]).expect("valid L tag"),
-                Tag::parse(["l", "help-wanted", "#t"]).expect("valid l tag"),
-            ],
-            200,
-        );
-
-        let labels = labels(&root, &[labels_event], &[maintainer.public_key()]);
-
-        assert_eq!(labels, vec!["bug", "help-wanted"]);
-    }
-
-    #[test]
-    fn labels_ignore_unauthorized_and_misnamed_events() {
-        let root = root_event();
-        let maintainer =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000002");
-        let stranger =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000003");
-
-        // A stranger's label event is not authorized.
-        let stranger_labels = signed(
-            &stranger,
-            Kind::Label,
-            vec![
-                e_tag(&root),
-                Tag::parse(["L", "#t"]).expect("valid L tag"),
-                Tag::parse(["l", "nope", "#t"]).expect("valid l tag"),
-            ],
-            200,
-        );
-        // A valid author referencing a different event.
-        let other_labels = signed(
-            &maintainer,
-            Kind::Label,
-            vec![
-                Tag::parse([
-                    "e",
-                    "2222222222222222222222222222222222222222222222222222222222222222",
-                ])
-                .expect("valid e tag"),
-                Tag::parse(["L", "#t"]).expect("valid L tag"),
-                Tag::parse(["l", "nope", "#t"]).expect("valid l tag"),
-            ],
-            200,
-        );
-        // A valid author without the namespace declaration.
-        let missing_namespace = signed(
-            &maintainer,
-            Kind::Label,
-            vec![
-                e_tag(&root),
-                Tag::parse(["l", "nope", "#t"]).expect("valid l tag"),
-            ],
-            200,
-        );
-
-        assert_eq!(
-            labels(
-                &root,
-                &[stranger_labels, other_labels, missing_namespace],
-                &[maintainer.public_key()]
-            ),
-            vec!["bug"]
-        );
-    }
-
-    #[test]
-    fn subject_override_latest_authorized_event_wins() {
-        let root = root_event();
-        let maintainer =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000002");
-        let older = signed(
-            &maintainer,
-            Kind::Label,
-            vec![
-                e_tag(&root),
-                Tag::parse(["L", "#subject"]).expect("valid L tag"),
-                Tag::parse(["l", "Old title", "#subject"]).expect("valid l tag"),
-            ],
-            200,
-        );
-        let newer = signed(
-            &maintainer,
-            Kind::Label,
-            vec![
-                e_tag(&root),
-                Tag::parse(["L", "#subject"]).expect("valid L tag"),
-                Tag::parse(["l", "New title", "#subject"]).expect("valid l tag"),
-            ],
-            300,
-        );
-
-        assert_eq!(
-            subject_override(&root, &[newer, older], &[maintainer.public_key()]),
-            Some("New title".to_owned())
-        );
-    }
-
-    #[test]
-    fn cover_note_latest_authorized_event_wins() {
-        let root = root_event();
-        let maintainer =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000002");
-        let stranger =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000003");
-        let older = signed(&maintainer, COVER_NOTE_KIND, vec![e_tag(&root)], 200);
-        let newer = signed(&maintainer, COVER_NOTE_KIND, vec![e_tag(&root)], 300);
-        let unauthorized = signed(&stranger, COVER_NOTE_KIND, vec![e_tag(&root)], 400);
-
-        let newer_id = newer.id;
-        let events = [older, unauthorized, newer];
-        let maintainers = [maintainer.public_key()];
-        let note = cover_note(&root, &events, &maintainers);
-        assert_eq!(note.map(|event| event.id), Some(newer_id));
-    }
-
-    #[test]
-    fn cover_note_none_without_valid_events() {
-        let root = root_event();
-
-        assert_eq!(cover_note(&root, &[], &[]), None);
-    }
-}

crates/signed_core/src/announcement.rs

@@ -0,0 +1,492 @@
+use std::collections::HashSet;
+
+use nostr::prelude::*;
+
+use crate::RepoAddr;
+use crate::upstream::Upstream;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Announcement {
+    pub event_id: EventId,
+    pub id: String,
+    pub owner: PublicKey,
+    pub created_at: Timestamp,
+    pub name: Option<String>,
+    pub description: Option<String>,
+    pub web: Vec<Url>,
+    pub clone: Vec<Url>,
+    pub relays: Vec<RelayUrl>,
+    pub euc: Option<String>,
+    pub maintainers: Vec<PublicKey>,
+    pub upstream: Option<Upstream>,
+    pub hashtags: Vec<String>,
+}
+
+impl Announcement {
+    /// Lists forks of the base, the user's own first.
+    pub fn forks_in<'a>(
+        announcements: &'a [Announcement],
+        base: &RepoAddr,
+        base_euc: Option<&str>,
+        user: Option<PublicKey>,
+    ) -> Vec<&'a Announcement> {
+        let (mut own, mut others) = (Vec::new(), Vec::new());
+        for announcement in announcements {
+            if announcement.clone.is_empty() || !announcement.is_fork_of(base, base_euc) {
+                continue;
+            }
+            if Some(announcement.owner) == user {
+                own.push(announcement);
+            } else {
+                others.push(announcement);
+            }
+        }
+        own.into_iter().chain(others).collect()
+    }
+
+    /// Parses a kind 30617 event, rejecting other kinds and missing `d` tags.
+    pub fn from_event(event: &Event) -> Option<Self> {
+        if event.kind != Kind::GitRepoAnnouncement {
+            return None;
+        }
+
+        let id = event.tags.identifier()?;
+
+        let mut hashtags: Vec<String> = Vec::new();
+        hashtags.extend(event.tags.hashtags().map(|t| t.to_string()));
+
+        let mut name: Option<String> = None;
+        let mut description: Option<String> = None;
+        let mut web: Vec<Url> = Vec::new();
+        let mut clone: Vec<Url> = Vec::new();
+        let mut relays: Vec<RelayUrl> = Vec::new();
+        let mut euc: Option<String> = None;
+        let mut maintainers: Vec<PublicKey> = Vec::new();
+        let mut upstream: Option<Upstream> = None;
+
+        for tag in event.tags.iter() {
+            match Nip34Tag::parse(tag.as_slice()) {
+                Ok(Nip34Tag::Name(value)) => name = Some(value),
+                Ok(Nip34Tag::Description(value)) => description = Some(value),
+                Ok(Nip34Tag::Web(urls)) => web.extend(urls),
+                Ok(Nip34Tag::Clone(urls)) => clone.extend(urls),
+                Ok(Nip34Tag::Relays(urls)) => relays.extend(urls),
+                Ok(Nip34Tag::EarliestUniqueCommitId(commit)) => euc = Some(commit.to_string()),
+                Ok(Nip34Tag::Maintainers(keys)) => maintainers.extend(keys),
+                _ => {}
+            }
+
+            if upstream.is_none() && tag.kind() == "u" {
+                let values = tag.as_slice();
+                let raw = values.get(1).map(String::as_str).unwrap_or_default();
+                if !raw.is_empty() {
+                    upstream = Some(Upstream::parse(raw));
+                }
+            }
+        }
+
+        Some(Self {
+            event_id: event.id,
+            owner: event.pubkey,
+            created_at: event.created_at,
+            id,
+            name,
+            description,
+            web,
+            clone,
+            relays,
+            euc,
+            maintainers,
+            upstream,
+            hashtags,
+        })
+    }
+
+    /// Returns the owner and identifier as a repository address.
+    pub fn addr(&self) -> RepoAddr {
+        RepoAddr::new(self.owner, self.id.clone())
+    }
+
+    /// Returns the name, defaulting to "Untitled".
+    pub fn name(&self) -> String {
+        self.name.clone().unwrap_or("Untitled".into())
+    }
+
+    /// Matches a `u` tag pointing at the base or a shared earliest unique commit.
+    pub fn is_fork_of(&self, base: &RepoAddr, base_euc: Option<&str>) -> bool {
+        if self.addr() == *base {
+            return false;
+        }
+        if self.upstream.as_ref().and_then(|u| u.addr.as_ref()) == Some(base) {
+            return true;
+        }
+        base_euc.is_some_and(|euc| self.euc.as_deref() == Some(euc))
+    }
+
+    /// Returns the description, defaulting to "No description".
+    pub fn description(&self) -> String {
+        self.description
+            .clone()
+            .unwrap_or("No description".to_string())
+    }
+
+    /// Adds the owner to the maintainers unless a `u` tag marks this a subordinate fork.
+    pub fn effective_maintainers(&self) -> Vec<PublicKey> {
+        let mut maintainers = self.maintainers.clone();
+        if self.upstream.is_none() && !maintainers.contains(&self.owner) {
+            maintainers.push(self.owner);
+        }
+        maintainers
+    }
+
+    /// Returns deduplicated `git clone` commands for the advertised URLs.
+    pub fn clone_urls(&self) -> Vec<String> {
+        let mut seen = HashSet::new();
+        self.clone
+            .iter()
+            .map(|url| format!("git clone {url}"))
+            .filter(|command| seen.insert(command.clone()))
+            .collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const MAINTAINER_HEX: &str = "68d81165918100b7da43fc28f7d1fc12554466e1115886b9e7bb326f65ec4272";
+
+    /// Returns the test signer keys.
+    fn keys() -> Keys {
+        Keys::new(
+            SecretKey::from_hex("0000000000000000000000000000000000000000000000000000000000000001")
+                .expect("valid secret key"),
+        )
+    }
+
+    /// Builds a signed repo announcement event from raw tags.
+    fn announcement_event(tags: &[&[&str]]) -> Event {
+        let tags: Vec<Tag> = tags
+            .iter()
+            .map(|t| Tag::parse(t.to_vec()).expect("valid tag"))
+            .collect();
+
+        EventBuilder::new(Kind::GitRepoAnnouncement, "")
+            .tags(tags)
+            .finalize(&keys())
+            .expect("signed event")
+    }
+
+    /// Parses an event carrying every supported tag.
+    #[test]
+    fn parses_full_announcement() {
+        let event = announcement_event(&[
+            &["d", "my-repo"],
+            &["name", "My Repo"],
+            &["description", "A test repository"],
+            &["web", "https://example.com/repo"],
+            &["clone", "https://example.com/repo.git"],
+            &["relays", "wss://relay.example.com"],
+            &["r", "aa231c4c6a5777dc89b42207b499891a344add5c", "euc"],
+            &["maintainers", MAINTAINER_HEX],
+            &["t", "rust"],
+            &["t", "nostr"],
+        ]);
+
+        let announcement = Announcement::from_event(&event).expect("parses");
+
+        assert_eq!(announcement.owner, keys().public_key());
+        assert_eq!(announcement.id, "my-repo");
+        assert_eq!(announcement.name.as_deref(), Some("My Repo"));
+        assert_eq!(
+            announcement.description.as_deref(),
+            Some("A test repository")
+        );
+        assert_eq!(
+            announcement.web,
+            vec![Url::parse("https://example.com/repo").unwrap()]
+        );
+        assert_eq!(
+            announcement.clone,
+            vec![Url::parse("https://example.com/repo.git").unwrap()]
+        );
+        assert_eq!(
+            announcement.relays,
+            vec![RelayUrl::parse("wss://relay.example.com").unwrap()]
+        );
+        assert_eq!(
+            announcement.euc.as_deref(),
+            Some("aa231c4c6a5777dc89b42207b499891a344add5c")
+        );
+        assert_eq!(
+            announcement.maintainers,
+            vec![PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey")]
+        );
+        assert_eq!(announcement.hashtags, vec!["rust", "nostr"]);
+    }
+
+    /// Skips malformed clone, relay, and maintainer values.
+    #[test]
+    fn drops_malformed_values() {
+        let event = announcement_event(&[
+            &["d", "my-repo"],
+            &["clone", "not a url"],
+            &["relays", "wss://good.example.com"],
+            &["maintainers", "not-a-pubkey"],
+        ]);
+
+        let announcement = Announcement::from_event(&event).expect("parses");
+
+        assert!(announcement.clone.is_empty());
+        assert_eq!(
+            announcement.relays,
+            vec![RelayUrl::parse("wss://good.example.com").unwrap()]
+        );
+        assert!(announcement.maintainers.is_empty());
+    }
+
+    /// Parses the `u` tag into an upstream coordinate.
+    #[test]
+    fn parses_upstream_tag() {
+        let event = announcement_event(&[
+            &["d", "my-fork"],
+            &[
+                "u",
+                "30617:68d81165918100b7da43fc28f7d1fc12554466e1115886b9e7bb326f65ec4272:upstream|https://example.com/upstream.git",
+                "wss://relay.example.com",
+            ],
+        ]);
+
+        let announcement = Announcement::from_event(&event).expect("parses");
+        let upstream = announcement.upstream.expect("parses the u tag");
+
+        assert_eq!(
+            upstream.addr,
+            Some(RepoAddr::new(
+                PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey"),
+                "upstream"
+            ))
+        );
+        assert_eq!(
+            upstream.raw,
+            "30617:68d81165918100b7da43fc28f7d1fc12554466e1115886b9e7bb326f65ec4272:upstream|https://example.com/upstream.git"
+        );
+        assert_eq!(
+            upstream.display().to_string(),
+            "30617:68d81165918100b7da43fc28f7d1fc12554466e1115886b9e7bb326f65ec4272:upstream"
+        );
+    }
+
+    /// Matches a fork through its `u` tag coordinate.
+    #[test]
+    fn is_fork_of_matches_the_u_tag_coordinate() {
+        let base = RepoAddr::new(
+            PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey"),
+            "upstream",
+        );
+        let event = announcement_event(&[&["d", "my-fork"], &["u", &base.to_string()]]);
+        let fork = Announcement::from_event(&event).expect("parses");
+
+        assert!(fork.is_fork_of(&base, None));
+    }
+
+    /// Matches forks sharing the base's earliest unique commit.
+    #[test]
+    fn is_fork_of_matches_a_shared_euc() {
+        let euc = "aa231c4c6a5777dc89b42207b499891a344add5c";
+        let base_event = announcement_event(&[&["d", "upstream"], &["r", euc, "euc"]]);
+        let base = Announcement::from_event(&base_event).expect("parses");
+        let base_addr = base.addr();
+
+        let fork_event = announcement_event(&[&["d", "mirror"], &["r", euc, "euc"]]);
+        let fork = Announcement::from_event(&fork_event).expect("parses");
+        assert!(fork.is_fork_of(&base_addr, base.euc.as_deref()));
+
+        let other_event = announcement_event(&[
+            &["d", "other"],
+            &["r", "bb231c4c6a5777dc89b42207b499891a344add5c", "euc"],
+        ]);
+        let other = Announcement::from_event(&other_event).expect("parses");
+        assert!(!other.is_fork_of(&base_addr, base.euc.as_deref()));
+
+        assert!(!fork.is_fork_of(&base_addr, None));
+    }
+
+    /// Matches permanent forks whose `u` tag points at the base despite a diverged EUC.
+    #[test]
+    fn is_fork_of_matches_permanent_forks_with_a_diverged_euc() {
+        let base = RepoAddr::new(
+            PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey"),
+            "upstream",
+        );
+        let base_euc = "aa231c4c6a5777dc89b42207b499891a344add5c";
+        let event = announcement_event(&[
+            &["d", "my-fork"],
+            &["u", &base.to_string()],
+            &["r", "cc231c4c6a5777dc89b42207b499891a344add5c", "euc"],
+        ]);
+        let fork = Announcement::from_event(&event).expect("parses");
+
+        assert!(fork.is_fork_of(&base, Some(base_euc)));
+    }
+
+    /// Includes the owner among maintainers for primary repositories.
+    #[test]
+    fn effective_maintainers_include_owner_for_primary_repos() {
+        let event = announcement_event(&[&["d", "my-repo"], &["maintainers", MAINTAINER_HEX]]);
+
+        let announcement = Announcement::from_event(&event).expect("parses");
+        let maintainers = announcement.effective_maintainers();
+
+        assert_eq!(maintainers.len(), 2);
+        assert!(maintainers.contains(&announcement.owner));
+        assert!(maintainers.contains(&PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey")));
+    }
+
+    /// Excludes the owner from maintainers for subordinate forks.
+    #[test]
+    fn effective_maintainers_exclude_owner_for_subordinate_forks() {
+        let event = announcement_event(&[
+            &["d", "my-fork"],
+            &["u", "30617:abc:upstream|https://example.com/upstream.git"],
+            &["maintainers", MAINTAINER_HEX],
+        ]);
+
+        let announcement = Announcement::from_event(&event).expect("parses");
+        let maintainers = announcement.effective_maintainers();
+
+        assert!(!maintainers.contains(&announcement.owner));
+        assert_eq!(
+            maintainers,
+            vec![PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey")]
+        );
+    }
+
+    const OWNER_KEYS: [&str; 3] = [
+        "0000000000000000000000000000000000000000000000000000000000000001",
+        "0000000000000000000000000000000000000000000000000000000000000002",
+        "0000000000000000000000000000000000000000000000000000000000000003",
+    ];
+
+    /// Builds an announcement event signed by the given owner key.
+    fn owned_announcement_event(owner: &str, tags: &[&[&str]]) -> Event {
+        let keys = Keys::new(SecretKey::from_hex(owner).expect("valid secret key"));
+        let tags: Vec<Tag> = tags
+            .iter()
+            .map(|t| Tag::parse(t.to_vec()).expect("valid tag"))
+            .collect();
+        EventBuilder::new(Kind::GitRepoAnnouncement, "")
+            .tags(tags)
+            .finalize(&keys)
+            .expect("signed event")
+    }
+
+    /// Builds one announcement owned by the owner key at the given index.
+    fn owned_announcements(owner_ix: usize, tags: &[&[&str]]) -> Vec<Announcement> {
+        vec![
+            Announcement::from_event(&owned_announcement_event(OWNER_KEYS[owner_ix], tags))
+                .expect("parses"),
+        ]
+    }
+
+    /// Places the user's own forks before everyone else's.
+    #[test]
+    fn fork_candidates_orders_own_forks_first() {
+        let euc = "aa231c4c6a5777dc89b42207b499891a344add5c";
+        let clone = "https://grasp.example/npub1x/my-fork.git";
+
+        let base_addr = RepoAddr::new(
+            PublicKey::from_hex(OWNER_KEYS[0]).expect("pubkey"),
+            "upstream",
+        );
+        let all = vec![
+            owned_announcements(
+                2,
+                &[
+                    &["d", "other-project"],
+                    &["r", "bb231c4c6a5777dc89b42207b499891a344add5c", "euc"],
+                ],
+            )
+            .pop()
+            .unwrap(),
+            owned_announcements(
+                1,
+                &[&["d", "my-fork"], &["r", euc, "euc"], &["clone", clone]],
+            )
+            .pop()
+            .unwrap(),
+            owned_announcements(
+                2,
+                &[
+                    &["d", "their-fork"],
+                    &["u", &base_addr.to_string()],
+                    &["clone", clone],
+                ],
+            )
+            .pop()
+            .unwrap(),
+        ];
+
+        let user = PublicKey::from_hex(OWNER_KEYS[1]).expect("pubkey");
+        let forks = Announcement::forks_in(&all, &base_addr, Some(euc), Some(user));
+
+        let ids: Vec<&str> = forks.iter().map(|a| a.id.as_str()).collect();
+        assert_eq!(ids, vec!["my-fork", "their-fork"]);
+    }
+
+    /// Excludes the base itself, unrelated repos, and repos without clone URLs.
+    #[test]
+    fn fork_candidates_excludes_base_unrelated_and_unfetchable() {
+        let euc = "aa231c4c6a5777dc89b42207b499891a344add5c";
+        let base_owner = PublicKey::from_hex(OWNER_KEYS[0]).expect("pubkey");
+        let base_addr = RepoAddr::new(base_owner, "upstream");
+
+        let mut all = vec![
+            owned_announcements(0, &[&["d", "upstream"], &["r", euc, "euc"]])
+                .pop()
+                .unwrap(),
+            owned_announcements(1, &[&["d", "no-clone-fork"], &["r", euc, "euc"]])
+                .pop()
+                .unwrap(),
+            owned_announcements(
+                2,
+                &[
+                    &["d", "other"],
+                    &["r", "cc231c4c6a5777dc89b42207b499891a344add5c", "euc"],
+                ],
+            )
+            .pop()
+            .unwrap(),
+            owned_announcements(
+                2,
+                &[
+                    &["d", "mirror"],
+                    &["r", euc, "euc"],
+                    &["clone", "https://grasp.example/x/mirror.git"],
+                ],
+            )
+            .pop()
+            .unwrap(),
+        ];
+
+        let forks = Announcement::forks_in(&all, &base_addr, Some(euc), Some(base_owner));
+        assert_eq!(forks.len(), 1);
+        assert_eq!(forks[0].id, "mirror");
+
+        all.push(
+            owned_announcements(
+                2,
+                &[
+                    &["d", "u-fork"],
+                    &["u", &base_addr.to_string()],
+                    &["clone", "https://grasp.example/x/u-fork.git"],
+                ],
+            )
+            .pop()
+            .unwrap(),
+        );
+        let forks = Announcement::forks_in(&all, &base_addr, None, Some(base_owner));
+        let ids: Vec<&str> = forks.iter().map(|a| a.id.as_str()).collect();
+        assert_eq!(ids, vec!["u-fork"]);
+    }
+}

crates/signed_core/src/clone_url.rs

@@ -1,116 +0,0 @@
-use nostr::prelude::*;
-
-use crate::RepoAddr;
-
-/// Target of a `nostr://` clone URL (NIP-34 "Nostr Clone URL format").
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum CloneTarget {
-    /// `nostr://<naddr1...>` — direct repository address.
-    Addr(RepoAddr),
-    /// `nostr://<npub|nip05>/[relay-hint/]<identifier>`
-    UserRepo {
-        /// `npub1...` or a NIP-05 identifier.
-        user: String,
-        relay_hint: Option<RelayUrl>,
-        /// `d` tag identifier of the repository.
-        identifier: String,
-    },
-}
-
-/// Parse a `nostr://` clone URL. Returns `None` for other URL schemes.
-pub fn parse_clone_url(url: &str) -> Option<CloneTarget> {
-    let rest = url.strip_prefix("nostr://")?;
-    let mut parts = rest.split('/');
-
-    let first = parts.next()?;
-    let second = parts.next()?;
-    let third = parts.next();
-
-    if first.starts_with("naddr1") {
-        let coordinate = Nip19Coordinate::from_bech32(first).ok()?;
-        return Some(CloneTarget::Addr(coordinate.coordinate));
-    }
-
-    let (relay_hint, identifier) = match third {
-        Some(id) => (
-            RelayUrl::parse(&percent_decode(second)).ok(),
-            percent_decode(id),
-        ),
-        None => (None, percent_decode(second)),
-    };
-
-    Some(CloneTarget::UserRepo {
-        user: first.to_owned(),
-        relay_hint,
-        identifier,
-    })
-}
-
-fn percent_decode(input: &str) -> String {
-    let bytes = input.as_bytes();
-    let mut out = Vec::with_capacity(bytes.len());
-    let mut i = 0;
-    while i < bytes.len() {
-        if bytes[i] == b'%' && i + 2 < bytes.len() {
-            let hex = &input[i + 1..i + 3];
-            if let Ok(v) = u8::from_str_radix(hex, 16) {
-                out.push(v);
-                i += 3;
-                continue;
-            }
-        }
-        out.push(bytes[i]);
-        i += 1;
-    }
-    String::from_utf8_lossy(&out).into_owned()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_user_repo_without_relay() {
-        let target = parse_clone_url(
-            "nostr://npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit",
-        )
-        .unwrap();
-        assert_eq!(
-            target,
-            CloneTarget::UserRepo {
-                user: "npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr".to_owned(),
-                relay_hint: None,
-                identifier: "ngit".to_owned(),
-            }
-        );
-    }
-
-    #[test]
-    fn parses_user_repo_with_relay_hint() {
-        let target = parse_clone_url("nostr://danconwaydev.com/relay.ngit.dev/ngit").unwrap();
-        assert_eq!(
-            target,
-            CloneTarget::UserRepo {
-                user: "danconwaydev.com".to_owned(),
-                relay_hint: RelayUrl::parse("relay.ngit.dev").ok(),
-                identifier: "ngit".to_owned(),
-            }
-        );
-    }
-
-    #[test]
-    fn decodes_percent_encoded_parts() {
-        let target = parse_clone_url(
-            "nostr://danconwaydev.com/ws%3A%2F%2Flocalhost%3A7334/my-local-only-repo",
-        )
-        .unwrap();
-        assert_eq!(
-            target,
-            CloneTarget::UserRepo {
-                user: "danconwaydev.com".to_owned(),
-                relay_hint: RelayUrl::parse("ws://localhost:7334").ok(),
-                identifier: "my-local-only-repo".to_owned(),
-            }
-        );
-    }
-}

crates/signed_core/src/comments.rs

@@ -1,161 +0,0 @@
-use std::collections::{HashMap, HashSet};
-
-use nostr::prelude::*;
-
-/// A NIP-22 comment thread: a top-level comment on the root event and its
-/// nested replies (oldest first at every level).
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct CommentThread {
-    /// The thread's top-level comment.
-    pub comment: Event,
-    /// Replies to [`Self::comment`], nested recursively.
-    pub replies: Vec<CommentThread>,
-}
-
-/// The direct parent of a comment (NIP-22 lowercase `e` tag), or `None` for
-/// comments without one.
-fn comment_parent(event: &Event) -> Option<EventId> {
-    event
-        .tags
-        .iter()
-        .find(|tag| tag.kind() == "e")
-        .and_then(Tag::content)
-        .and_then(|id| EventId::parse(id).ok())
-}
-
-/// Group the comments on a root event (issue / patch / PR) into NIP-22
-/// threads. A comment whose parent is the root itself starts a thread; other
-/// comments nest under their parent comment. Threads and replies are ordered
-/// oldest-first. Replies whose parent comment is missing (e.g. not fetched)
-/// are placed as top-level threads so they are not dropped.
-pub fn comment_threads(root: &Event, comments: &[Event]) -> Vec<CommentThread> {
-    // Index comments by their parent id. Comments without a parent tag are
-    // treated as replying to the root event itself.
-    let mut children: HashMap<EventId, Vec<&Event>> = HashMap::new();
-    for comment in comments {
-        let parent = comment_parent(comment).unwrap_or(root.id);
-        children.entry(parent).or_default().push(comment);
-    }
-    for list in children.values_mut() {
-        list.sort_by_key(|event| event.created_at);
-    }
-
-    let mut visited: HashSet<EventId> = HashSet::new();
-
-    fn build(
-        id: EventId,
-        children: &HashMap<EventId, Vec<&Event>>,
-        visited: &mut HashSet<EventId>,
-    ) -> Vec<CommentThread> {
-        let Some(list) = children.get(&id) else {
-            return Vec::new();
-        };
-        let mut threads = Vec::new();
-        for event in list {
-            // Guards against malformed reply cycles.
-            if visited.insert(event.id) {
-                threads.push(CommentThread {
-                    comment: (*event).clone(),
-                    replies: build(event.id, children, visited),
-                });
-            }
-        }
-        threads
-    }
-
-    let mut threads = build(root.id, &children, &mut visited);
-
-    // Orphan replies: their parent comment is unknown, so they never appear
-    // in the tree rooted at the root event; surface them as top-level threads.
-    let mut orphans: Vec<&Event> = comments
-        .iter()
-        .filter(|event| !visited.contains(&event.id))
-        .collect();
-    orphans.sort_by_key(|event| event.created_at);
-    for comment in orphans {
-        if visited.insert(comment.id) {
-            threads.push(CommentThread {
-                comment: comment.clone(),
-                replies: build(comment.id, &children, &mut visited),
-            });
-        }
-    }
-
-    threads
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn comment(keys: &Keys, parent: Option<&Event>, content: &str, created_at: u64) -> Event {
-        let tags = parent
-            .map(|parent| vec![Tag::parse(["e", &parent.id.to_hex()]).expect("valid e tag")])
-            .unwrap_or_default();
-        EventBuilder::new(Kind::Comment, content)
-            .tags(tags)
-            .custom_created_at(Timestamp::from(created_at))
-            .finalize(keys)
-            .expect("signed event")
-    }
-
-    fn flatten(threads: &[CommentThread]) -> Vec<String> {
-        let mut out = Vec::new();
-        for thread in threads {
-            out.push(thread.comment.content.clone());
-            out.extend(flatten(&thread.replies));
-        }
-        out
-    }
-
-    #[test]
-    fn nests_replies_under_their_parents() {
-        let keys = Keys::generate();
-        let root = EventBuilder::new(Kind::GitIssue, "issue")
-            .finalize(&keys)
-            .expect("signed event");
-
-        let a = comment(&keys, Some(&root), "a", 100);
-        let a1 = comment(&keys, Some(&a), "a1", 200);
-        let a2 = comment(&keys, Some(&a), "a2", 300);
-        let b = comment(&keys, Some(&root), "b", 150);
-
-        let threads = comment_threads(&root, &[a2, b, a, a1]);
-
-        assert_eq!(flatten(&threads), vec!["a", "a1", "a2", "b"]);
-    }
-
-    #[test]
-    fn comments_without_a_parent_tag_attach_to_the_root() {
-        let keys = Keys::generate();
-        let root = EventBuilder::new(Kind::GitIssue, "issue")
-            .finalize(&keys)
-            .expect("signed event");
-
-        // Old-style comments carried no `e` tag at all.
-        let orphan = comment(&keys, None, "no parent", 100);
-
-        let threads = comment_threads(&root, &[orphan]);
-
-        assert_eq!(flatten(&threads), vec!["no parent"]);
-    }
-
-    #[test]
-    fn orphan_replies_are_surfaced_as_top_level_threads() {
-        let keys = Keys::generate();
-        let root = EventBuilder::new(Kind::GitIssue, "issue")
-            .finalize(&keys)
-            .expect("signed event");
-        let a = comment(&keys, Some(&root), "a", 100);
-
-        // `missing` is not in the comment set; its reply should still show up.
-        let missing = EventBuilder::new(Kind::Comment, "missing")
-            .finalize(&keys)
-            .expect("signed event");
-        let reply_to_missing = comment(&keys, Some(&missing), "reply to missing", 200);
-
-        let threads = comment_threads(&root, &[a, reply_to_missing]);
-
-        assert_eq!(flatten(&threads), vec!["a", "reply to missing"]);
-    }
-}

crates/signed_core/src/deletions.rs

@@ -2,24 +2,18 @@ use std::collections::HashSet;
 
 use nostr::prelude::*;
 
-/// NIP-09 deletion requests and NIP-62 vanish requests, used to hide
-/// deleted events before they reach the UI.
-///
-/// Built from the kind-5 / kind-62 events stored in the local database;
-/// pass any event through [`Deletions::is_deleted`] before displaying it.
 pub struct Deletions {
-    /// `(deleted event id, expected author)` from `e` tags of kind-5 events.
     ids: HashSet<(EventId, PublicKey)>,
-    /// `(coordinate, expected author, cutoff)` from `a` tags of kind-5 events.
-    /// All versions of the addressable event up to `cutoff` are deleted.
     coords: Vec<(Coordinate, PublicKey, Timestamp)>,
-    /// `(author, cutoff)` from kind-62 vanish requests.
     vanished: Vec<(PublicKey, Timestamp)>,
 }
 
 impl Deletions {
-    /// Build the deletion index from raw kind-5 and kind-62 events.
-    pub fn from_events(events: impl IntoIterator<Item = Event>) -> Self {
+    /// Builds a [`Deletions`] instance from a collection of events.
+    pub fn from_events<E>(events: E) -> Self
+    where
+        E: IntoIterator<Item = Event>,
+    {
         let mut ids = HashSet::new();
         let mut coords = Vec::new();
         let mut vanished = Vec::new();
@@ -34,8 +28,6 @@ impl Deletions {
                         .map(|c| (c, event.pubkey, event.created_at)),
                 );
             } else if event.kind == Kind::RequestToVanish {
-                // Client-side we can't verify which relay the request targeted,
-                // so any vanish request is honored for the author's events.
                 vanished.push((event.pubkey, event.created_at));
             }
         }
@@ -47,11 +39,7 @@ impl Deletions {
         }
     }
 
-    /// Whether the event is covered by a valid deletion or vanish request.
-    ///
-    /// A request is only valid when its author matches the deleted event's
-    /// author (NIP-09); addressable events are deleted up to the request's
-    /// `created_at`.
+    /// Returns whether the given event is deleted.
     pub fn is_deleted(&self, event: &Event) -> bool {
         if self
             .vanished

crates/signed_core/src/filters.rs

@@ -2,150 +2,227 @@ use std::time::Duration;
 
 use nostr::prelude::*;
 
-use crate::RepoAddr;
-
-/// Kinds that make up the activity of a repository.
 pub const ACTIVITY_KINDS: [Kind; 9] = [
+    Kind::Comment,
     Kind::GitPatch,
     Kind::GitPullRequest,
     Kind::GitPullRequestUpdate,
     Kind::GitIssue,
-    Kind::Comment,
     Kind::GitStatusOpen,
     Kind::GitStatusApplied,
     Kind::GitStatusClosed,
     Kind::GitStatusDraft,
 ];
 
-/// Latest announcement event for a repository.
-pub fn announcement(addr: &RepoAddr) -> Filter {
-    Filter::new()
-        .kind(Kind::GitRepoAnnouncement)
-        .author(addr.public_key)
-        .identifier(addr.identifier.clone())
+const NOTIFICATION_KINDS: [Kind; 8] = [
+    Kind::GitIssue,
+    Kind::GitPullRequest,
+    Kind::GitPatch,
+    Kind::GitPullRequestUpdate,
+    Kind::GitStatusOpen,
+    Kind::GitStatusApplied,
+    Kind::GitStatusClosed,
+    Kind::GitStatusDraft,
+];
+
+const GIT_ROOT_KINDS: [Kind; 4] = [
+    Kind::GitIssue,
+    Kind::GitPatch,
+    Kind::GitPullRequest,
+    Kind::GitRepoAnnouncement,
+];
+
+pub fn is_repo_kind(kind: Kind) -> bool {
+    kind == Kind::GitRepoAnnouncement
+        || kind == Kind::RepoState
+        || kind == Kind::EventDeletion
+        || kind == Kind::RequestToVanish
+        || ACTIVITY_KINDS.contains(&kind)
 }
 
-/// Latest state event (refs / HEAD) for a repository.
-pub fn state(addr: &RepoAddr) -> Filter {
-    Filter::new()
-        .kind(Kind::RepoState)
-        .author(addr.public_key)
-        .identifier(addr.identifier.clone())
+fn tag_kind(event: &Event, name: &str) -> Option<Kind> {
+    event
+        .tags
+        .iter()
+        .find(|tag| tag.kind() == name)
+        .and_then(|tag| tag.content())
+        .and_then(|value| value.parse::<Kind>().ok())
 }
 
-/// All NIP-34 activity addressed to a repository (`#a` tag): issues, PRs,
-/// patches, statuses and comments (kind 1111).
-///
-/// Note: the `a` tag on status events is optional per NIP-34, so statuses
-/// published without it won't be matched here.
-pub fn activity(addr: &RepoAddr) -> Filter {
-    Filter::new().kinds(ACTIVITY_KINDS).coordinate(addr)
-}
+pub struct Filters;
 
-/// Status events (`1630..=1633`) referencing any of the given root events
-/// (`#e` tag). Batched: one filter covers all roots, so a negentropy sync
-/// reconciles them in a single session instead of one per root.
-pub fn statuses_for(roots: impl IntoIterator<Item = EventId>) -> Filter {
-    Filter::new()
-        .kinds([
-            Kind::GitStatusOpen,
-            Kind::GitStatusApplied,
-            Kind::GitStatusClosed,
-            Kind::GitStatusDraft,
-        ])
-        .events(roots)
-}
+impl Filters {
+    const DELETIONS_LOOKBACK: Duration = Duration::from_secs(3 * 365 * 86_400);
 
-/// Cover notes (kind 1624) and NIP-32 label events (kind 1985) referencing
-/// any of the given root events (`#e` tag), fetched per root like comments
-/// and statuses because they carry no repository `a` tag. Batched, like
-/// [`statuses_for`].
-pub fn annotations_for(roots: impl IntoIterator<Item = EventId>) -> Filter {
-    Filter::new()
-        .kinds([crate::COVER_NOTE_KIND, Kind::Label])
-        .events(roots)
-}
-
-/// A user's grasp list (kind `10317`).
-pub fn grasp_list(public_key: PublicKey) -> Filter {
-    Filter::new()
-        .kind(Kind::GitUserGraspList)
-        .author(public_key)
-}
-
-/// NIP-22 comments (kind `1111`) referencing any of the given root events
-/// (issues, patches, PRs).
-///
-/// Comments carry no repository `a` tag, so they must be fetched by their
-/// root reference. NIP-22 defines the uppercase `E` tag as the thread root
-/// (used by ngit), but some clients (including Signed) use a lowercase `e`
-/// tag, so both are matched.
-///
-/// Returns two filters because `#E` and `#e` conditions would be ANDed if
-/// combined into one.
-pub fn comments_for(roots: impl IntoIterator<Item = EventId>) -> Vec<Filter> {
-    let roots: Vec<String> = roots.into_iter().map(|id| id.to_hex()).collect();
-    if roots.is_empty() {
-        return Vec::new();
+    pub fn statuses_for(roots: impl IntoIterator<Item = EventId>) -> Filter {
+        Filter::new()
+            .kinds([
+                Kind::GitStatusOpen,
+                Kind::GitStatusApplied,
+                Kind::GitStatusClosed,
+                Kind::GitStatusDraft,
+            ])
+            .events(roots)
     }
-    vec![
+
+    pub fn grasp_list(public_key: PublicKey) -> Filter {
+        Filter::new()
+            .kind(Kind::GitUserGraspList)
+            .author(public_key)
+    }
+
+    /// NIP-51: code (people who produce NIP-34 events) follow list
+    pub fn git_authors(public_key: PublicKey) -> Filter {
+        Filter::new().kind(Kind::Custom(10017)).author(public_key)
+    }
+
+    /// NIP-51: NIP-34 followed repositories
+    pub fn git_repos(public_key: PublicKey) -> Filter {
+        Filter::new().kind(Kind::Custom(10018)).author(public_key)
+    }
+
+    /// Replaceable events, so the latest of each kind is all we need.
+    pub fn user_metadata(public_key: PublicKey) -> Vec<Filter> {
+        vec![
+            Self::grasp_list(public_key).limit(1),
+            Self::git_authors(public_key).limit(1),
+            Self::git_repos(public_key).limit(1),
+            Filter::new()
+                .kind(Kind::ContactList)
+                .author(public_key)
+                .limit(1),
+            Filter::new()
+                .kind(Kind::Metadata)
+                .author(public_key)
+                .limit(1),
+            Filter::new()
+                .kind(Kind::MuteList)
+                .author(public_key)
+                .limit(1),
+            Filter::new()
+                .kind(Kind::BlossomServerList)
+                .author(public_key)
+                .limit(1),
+        ]
+    }
+
+    pub fn comments_for(roots: impl IntoIterator<Item = EventId>) -> Vec<Filter> {
+        let roots: Vec<String> = roots.into_iter().map(|id| id.to_hex()).collect();
+
+        if roots.is_empty() {
+            return Vec::new();
+        }
+
+        vec![
+            Filter::new()
+                .kind(Kind::Comment)
+                .custom_tags(SingleLetterTag::UPPERCASE_E, roots.clone()),
+            Filter::new()
+                .kind(Kind::Comment)
+                .custom_tags(SingleLetterTag::LOWERCASE_E, roots),
+        ]
+    }
+
+    fn notification_comments(me: PublicKey) -> Filter {
         Filter::new()
             .kind(Kind::Comment)
-            .custom_tags(SingleLetterTag::UPPERCASE_E, roots.clone()),
-        Filter::new()
-            .kind(Kind::Comment)
-            .custom_tags(SingleLetterTag::LOWERCASE_E, roots),
-    ]
-}
+            .custom_tags(SingleLetterTag::UPPERCASE_P, [me.to_hex()])
+            .custom_tags(SingleLetterTag::UPPERCASE_K, ["1621", "1617", "1618"])
+    }
 
-/// All repositories announced by an author.
-pub fn announcements_by(public_key: PublicKey) -> Filter {
-    Filter::new()
-        .kind(Kind::GitRepoAnnouncement)
-        .author(public_key)
-}
+    pub fn notifications(me: PublicKey) -> Vec<Filter> {
+        vec![
+            Self::notification_comments(me),
+            Filter::new().kinds(NOTIFICATION_KINDS).pubkey(me),
+        ]
+    }
 
-/// All repository announcements (for global discovery).
-///
-/// Unbounded: intended for negentropy sync, which reconciles sets
-/// efficiently regardless of size. Local database queries with this
-/// filter are served by LMDB, so they stay fast as the database grows.
-pub fn all_announcements() -> Filter {
-    Filter::new().kind(Kind::GitRepoAnnouncement)
-}
+    pub fn authored_activity(me: PublicKey) -> Filter {
+        Filter::new().kinds(ACTIVITY_KINDS).author(me)
+    }
 
-/// How far back deletion requests are fetched and stored.
-///
-/// A deletion request can only target events created before it, and NIP-34
-/// events are all far younger than this window, so older requests can never
-/// match anything shown. Bounding the window keeps the kind-5/62 set (one of
-/// the largest on public relays) from being fully reconciled on every sync.
-const DELETIONS_LOOKBACK: Duration = Duration::from_secs(3 * 365 * 86_400);
+    pub fn all_announcements() -> Filter {
+        Filter::new().kind(Kind::GitRepoAnnouncement)
+    }
 
-/// `now` minus [`DELETIONS_LOOKBACK`], quantized to whole days so identical
-/// filters hash the same and the backend's sync dedup can match them.
-fn deletions_since() -> Timestamp {
-    let now = Timestamp::now().as_secs();
-    Timestamp::from_secs(now - now % 86_400) - DELETIONS_LOOKBACK
-}
+    pub fn all_states() -> Filter {
+        Filter::new().kind(Kind::RepoState)
+    }
 
-/// All deletion-related events (NIP-09 kind `5`, NIP-62 kind `62`) within
-/// [`DELETIONS_LOOKBACK`]. Deletion requests must be known before any other
-/// event can be shown.
-pub fn deletions() -> Filter {
-    Filter::new()
-        .kinds([Kind::EventDeletion, Kind::RequestToVanish])
-        .since(deletions_since())
-}
+    fn deletions_since() -> Timestamp {
+        let now = Timestamp::now().as_secs();
+        Timestamp::from_secs(now - now % 86_400) - Self::DELETIONS_LOOKBACK
+    }
 
-/// Deletion events relevant to a single repository: requests authored by
-/// the repository owner and requests addressed to the repository
-/// coordinate (`#a` tag).
-pub fn deletions_for_repo(addr: &RepoAddr) -> Vec<Filter> {
-    vec![
+    pub fn deletions() -> Filter {
         Filter::new()
             .kinds([Kind::EventDeletion, Kind::RequestToVanish])
-            .author(addr.public_key),
-        Filter::new().kind(Kind::EventDeletion).coordinate(addr),
-    ]
+            .since(Self::deletions_since())
+    }
+}
+
+pub(crate) fn is_git_comment(event: &Event) -> bool {
+    event.kind == Kind::Comment
+        && tag_kind(event, "K").is_some_and(|kind| GIT_ROOT_KINDS.contains(&kind))
+}
+
+pub(crate) fn is_git_status(event: &Event) -> bool {
+    tag_kind(event, "k").is_some_and(|kind| GIT_ROOT_KINDS.contains(&kind))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::GitEvent;
+
+    fn keys(seed: u8) -> Keys {
+        let mut hex = "00000000000000000000000000000000000000000000000000000000000000".to_string();
+        hex.push_str(&format!("{seed:02x}"));
+        Keys::new(SecretKey::from_hex(&hex).expect("valid secret key"))
+    }
+
+    fn signed(author: &Keys, kind: Kind, tags: Vec<Tag>) -> Event {
+        EventBuilder::new(kind, "")
+            .tags(tags)
+            .finalize(author)
+            .expect("signed event")
+    }
+
+    fn kind_tag(name: &str, kind: Kind) -> Tag {
+        Tag::parse([name, &kind.as_u16().to_string()]).expect("valid kind tag")
+    }
+
+    #[test]
+    fn comment_activity_depends_on_the_uppercase_k_tag() {
+        let on_git = signed(&keys(1), Kind::Comment, vec![kind_tag("K", Kind::GitIssue)]);
+        let on_repo = signed(
+            &keys(1),
+            Kind::Comment,
+            vec![kind_tag("K", Kind::GitRepoAnnouncement)],
+        );
+        let on_note = signed(&keys(1), Kind::Comment, vec![kind_tag("K", Kind::TextNote)]);
+
+        assert!(on_git.is_git_activity());
+        assert!(on_repo.is_git_activity());
+        assert!(!on_note.is_git_activity());
+        assert!(!signed(&keys(1), Kind::Comment, Vec::new()).is_git_activity());
+    }
+
+    #[test]
+    fn status_activity_depends_on_the_lowercase_k_tag() {
+        let status = signed(
+            &keys(1),
+            Kind::GitStatusClosed,
+            vec![kind_tag("k", Kind::GitPullRequest)],
+        );
+        let unrelated = signed(
+            &keys(1),
+            Kind::GitStatusClosed,
+            vec![kind_tag("k", Kind::Metadata)],
+        );
+
+        assert!(status.is_git_activity());
+        assert!(!unrelated.is_git_activity());
+        assert!(!signed(&keys(1), Kind::GitStatusClosed, Vec::new()).is_git_activity());
+    }
 }

crates/signed_core/src/git_event.rs

@@ -0,0 +1,145 @@
+use nostr::prelude::*;
+
+pub trait GitEvent {
+    /// Returns the NIP-34 subject or the first non-empty content line.
+    fn activity_subject(&self) -> String;
+
+    /// Returns the current commit id.
+    fn current_commit(&self) -> Option<String>;
+
+    /// Returns the merge base commit id.
+    fn merge_base(&self) -> Option<String>;
+
+    /// Returns the advertised clone URLs.
+    fn clone_urls(&self) -> Option<Vec<Url>>;
+
+    /// Returns the branch name.
+    fn branch_name(&self) -> Option<String>;
+
+    /// Returns whether the event is git activity.
+    fn is_git_activity(&self) -> bool;
+
+    /// Returns whether an `e` or `E` tag points at the root event.
+    fn references_root(&self, root: &EventId) -> bool;
+}
+
+impl GitEvent for Event {
+    /// Reads the subject tag, then the first content line, then "Untitled".
+    fn activity_subject(&self) -> String {
+        let subject = self
+            .tags
+            .iter()
+            .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
+                Ok(Nip34Tag::Subject(subject)) => Some(subject),
+                _ => None,
+            });
+
+        subject
+            .or_else(|| {
+                self.content
+                    .lines()
+                    .map(str::trim)
+                    .find(|line| !line.is_empty())
+                    .map(|value| value.to_string())
+            })
+            .unwrap_or("Untitled".to_string())
+    }
+
+    /// Reads the `commit` tag.
+    fn current_commit(&self) -> Option<String> {
+        self.tags
+            .iter()
+            .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
+                Ok(Nip34Tag::CurrentCommit(commit)) => Some(commit.to_string()),
+                _ => None,
+            })
+    }
+
+    /// Reads the `merge-base` tag.
+    fn merge_base(&self) -> Option<String> {
+        self.tags
+            .iter()
+            .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
+                Ok(Nip34Tag::MergeBase(commit)) => Some(commit.to_string()),
+                _ => None,
+            })
+    }
+
+    /// Reads the `clone` tag.
+    fn clone_urls(&self) -> Option<Vec<Url>> {
+        self.tags
+            .iter()
+            .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
+                Ok(Nip34Tag::Clone(urls)) => Some(urls),
+                _ => None,
+            })
+    }
+
+    /// Reads the `branch-name` tag.
+    fn branch_name(&self) -> Option<String> {
+        self.tags
+            .iter()
+            .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
+                Ok(Nip34Tag::BranchName(name)) => Some(name),
+                _ => None,
+            })
+    }
+
+    /// Classifies git issue, patch, pull request, comment, and status kinds.
+    fn is_git_activity(&self) -> bool {
+        match self.kind {
+            Kind::GitIssue | Kind::GitPatch | Kind::GitPullRequest => true,
+            Kind::Comment => crate::filters::is_git_comment(self),
+            Kind::GitStatusOpen
+            | Kind::GitStatusApplied
+            | Kind::GitStatusClosed
+            | Kind::GitStatusDraft => crate::filters::is_git_status(self),
+            _ => false,
+        }
+    }
+
+    /// Compares `e` and `E` tag contents against the root id.
+    fn references_root(&self, root: &EventId) -> bool {
+        let root = root.to_hex();
+        self.tags
+            .iter()
+            .any(|tag| matches!(tag.kind(), "e" | "E") && tag.content() == Some(root.as_str()))
+    }
+}
+
+impl<T: GitEvent + ?Sized> GitEvent for &T {
+    /// Delegates to the referenced event.
+    fn activity_subject(&self) -> String {
+        (*self).activity_subject()
+    }
+
+    /// Delegates to the referenced event.
+    fn current_commit(&self) -> Option<String> {
+        (*self).current_commit()
+    }
+
+    /// Delegates to the referenced event.
+    fn merge_base(&self) -> Option<String> {
+        (*self).merge_base()
+    }
+
+    /// Delegates to the referenced event.
+    fn clone_urls(&self) -> Option<Vec<Url>> {
+        (*self).clone_urls()
+    }
+
+    /// Delegates to the referenced event.
+    fn branch_name(&self) -> Option<String> {
+        (*self).branch_name()
+    }
+
+    /// Delegates to the referenced event.
+    fn is_git_activity(&self) -> bool {
+        (*self).is_git_activity()
+    }
+
+    /// Delegates to the referenced event.
+    fn references_root(&self, root: &EventId) -> bool {
+        (*self).references_root(root)
+    }
+}

crates/signed_core/src/inbox/group.rs

@@ -0,0 +1,172 @@
+use std::collections::HashMap;
+
+use nostr::prelude::*;
+use utils::sort_newest_first;
+
+use super::{InboxItem, InboxReadState, ThreadResolver};
+use crate::RepoAddr;
+
+/// Groups events into inbox threads, merging the user's own events.
+pub fn group<E, O, L>(
+    events: E,
+    own: O,
+    me: PublicKey,
+    state: &InboxReadState,
+    lookup: &L,
+) -> Vec<InboxItem>
+where
+    E: IntoIterator<Item = Event>,
+    O: IntoIterator<Item = Event>,
+    L: Fn(EventId) -> Option<Event>,
+{
+    let resolver = ThreadResolver::new(lookup);
+    let mut groups: HashMap<EventId, Vec<Event>> = HashMap::new();
+    for event in events {
+        if event.pubkey == me {
+            continue;
+        }
+        let Some(root) = resolver.notification_root(&event) else {
+            continue;
+        };
+        groups.entry(root).or_default().push(event);
+    }
+
+    let mut own_groups: HashMap<EventId, Vec<Event>> = HashMap::new();
+    for event in own {
+        let root = resolver.notification_root(&event).unwrap_or(event.id);
+        own_groups.entry(root).or_default().push(event);
+    }
+
+    let mut roots: Vec<EventId> = groups.keys().chain(own_groups.keys()).copied().collect();
+    roots.sort();
+    roots.dedup();
+
+    let mut items: Vec<InboxItem> = roots
+        .into_iter()
+        .map(|root| {
+            let mut events = groups.remove(&root).unwrap_or_default();
+            let mut own_events = own_groups.remove(&root).unwrap_or_default();
+            sort_newest_first(&mut events);
+            sort_newest_first(&mut own_events);
+
+            let root_event = lookup(root);
+
+            let mut item = InboxItem {
+                root,
+                address: root_event
+                    .as_ref()
+                    .and_then(|event| event.tags.coordinates().next())
+                    .map(RepoAddr::from),
+                root_event,
+                events,
+                own_events,
+                unread_ids: Vec::new(),
+                archived: false,
+            };
+            item.apply_state(state);
+            item
+        })
+        .collect();
+
+    items.sort_by(|a, b| {
+        b.latest_activity()
+            .cmp(&a.latest_activity())
+            .then_with(|| b.root.to_hex().cmp(&a.root.to_hex()))
+    });
+
+    items
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Derives deterministic signer keys from a seed byte.
+    fn keys(seed: u8) -> Keys {
+        let mut hex = "00000000000000000000000000000000000000000000000000000000000000".to_string();
+        hex.push_str(&format!("{seed:02x}"));
+        Keys::new(SecretKey::from_hex(&hex).expect("valid secret key"))
+    }
+
+    /// Builds a signed event with a fixed timestamp.
+    fn signed(author: &Keys, kind: Kind, tags: Vec<Tag>, created_at: u64) -> Event {
+        EventBuilder::new(kind, "")
+            .tags(tags)
+            .custom_created_at(Timestamp::from_secs(created_at))
+            .finalize(author)
+            .expect("signed event")
+    }
+
+    /// Builds an uppercase `E` tag for the event.
+    fn uppercase_e_tag(event: &Event) -> Tag {
+        Tag::parse(["E", &event.id.to_hex()]).expect("valid E tag")
+    }
+
+    /// Builds an event lookup closure over a slice.
+    fn lookup(events: &[Event]) -> impl Fn(EventId) -> Option<Event> + '_ {
+        move |id| events.iter().find(|event| event.id == id).cloned()
+    }
+
+    /// Builds a git issue event with a subject tag.
+    fn titled_issue(author: &Keys, title: &str, at: u64) -> Event {
+        signed(
+            author,
+            Kind::GitIssue,
+            vec![Tag::parse(["subject", title]).expect("valid subject tag")],
+            at,
+        )
+    }
+
+    /// Merges the user's own events into the matching thread.
+    #[test]
+    fn group_merges_own_events_into_the_matching_thread() {
+        let me = keys(1);
+        let issue = titled_issue(&me, "Add retry logic", 100);
+        let mine = signed(
+            &me,
+            Kind::Comment,
+            vec![
+                uppercase_e_tag(&issue),
+                Tag::parse(["K", "1621"]).expect("K tag"),
+            ],
+            150,
+        );
+        let reply = signed(
+            &keys(2),
+            Kind::Comment,
+            vec![
+                uppercase_e_tag(&issue),
+                Tag::parse(["K", "1621"]).expect("K tag"),
+            ],
+            200,
+        );
+
+        let context = [issue.clone(), mine.clone(), reply.clone()];
+        let items = group(
+            [reply.clone()],
+            [issue.clone(), mine.clone()],
+            me.public_key(),
+            &InboxReadState::default(),
+            &lookup(&context),
+        );
+
+        assert_eq!(items.len(), 1);
+        assert_eq!(items[0].root, issue.id);
+        assert_eq!(
+            items[0].root_event.as_ref().map(|event| event.id),
+            Some(issue.id)
+        );
+        assert_eq!(items[0].kind(), Some(Kind::GitIssue));
+        assert_eq!(items[0].title(), "Add retry logic");
+        assert_eq!(items[0].events, vec![reply.clone()]);
+        assert_eq!(items[0].own_events, vec![mine.clone(), issue.clone()]);
+        assert_eq!(
+            items[0]
+                .timeline(5)
+                .iter()
+                .map(|event| event.id)
+                .collect::<Vec<_>>(),
+            vec![issue.id, mine.id, reply.id]
+        );
+    }
+}

crates/signed_core/src/inbox/item.rs

@@ -0,0 +1,99 @@
+use std::collections::HashSet;
+
+use nostr::prelude::*;
+
+use super::InboxReadState;
+use crate::{GitEvent, RepoAddr};
+
+#[derive(Debug, Clone)]
+pub struct InboxItem {
+    pub root: EventId,
+    pub root_event: Option<Event>,
+    pub address: Option<RepoAddr>,
+    pub events: Vec<Event>,
+    pub own_events: Vec<Event>,
+    pub unread_ids: Vec<EventId>,
+    pub archived: bool,
+}
+
+impl InboxItem {
+    /// Returns the thread title from the root, own events, or events.
+    pub fn title(&self) -> String {
+        self.root_event
+            .as_ref()
+            .or_else(|| self.own_events.first())
+            .or_else(|| self.events.first())
+            .map(|event| event.activity_subject())
+            .unwrap_or_else(|| "Untitled".to_string())
+    }
+
+    /// Returns the kind of the thread's primary event.
+    pub fn kind(&self) -> Option<Kind> {
+        self.root_event
+            .as_ref()
+            .or_else(|| self.own_events.first())
+            .or_else(|| self.events.first())
+            .map(|event| event.kind)
+    }
+
+    /// Returns the newest timestamp among the root, own, and other events.
+    pub fn latest_activity(&self) -> Timestamp {
+        self.root_event
+            .as_ref()
+            .into_iter()
+            .chain(self.own_events.first())
+            .chain(self.events.first())
+            .map(|event| event.created_at)
+            .max()
+            .unwrap_or_default()
+    }
+
+    /// Builds a chronological timeline capped at `limit` events, root first.
+    pub fn timeline(&self, limit: usize) -> Vec<Event> {
+        let mut seen: HashSet<EventId> = HashSet::new();
+        let mut events: Vec<Event> = Vec::new();
+
+        if let Some(root) = &self.root_event {
+            seen.insert(root.id);
+            events.push(root.clone());
+        }
+
+        let mut rest: Vec<Event> = self
+            .own_events
+            .iter()
+            .chain(self.events.iter())
+            .filter(|event| seen.insert(event.id))
+            .cloned()
+            .collect();
+
+        rest.sort_by(|a, b| {
+            b.created_at
+                .cmp(&a.created_at)
+                .then_with(|| b.id.to_hex().cmp(&a.id.to_hex()))
+        });
+        rest.truncate(limit.saturating_sub(events.len()));
+        events.extend(rest);
+
+        events.sort_by_key(|event| event.created_at);
+        events
+    }
+
+    /// Returns whether the thread has unread events and is not archived.
+    pub fn is_unread(&self) -> bool {
+        !self.archived && !self.unread_ids.is_empty()
+    }
+
+    /// Recomputes unread ids and the archived flag from the read state.
+    pub fn apply_state(&mut self, state: &InboxReadState) {
+        self.unread_ids = self
+            .events
+            .iter()
+            .rev()
+            .filter(|event| !state.is_read(event))
+            .map(|event| event.id)
+            .collect();
+
+        self.archived =
+            !self.events.is_empty() && self.events.iter().all(|event| state.is_archived(event));
+    }
+}

crates/signed_core/src/inbox/mod.rs

@@ -0,0 +1,9 @@
+mod group;
+mod item;
+mod read_state;
+mod resolver;
+
+pub use group::group;
+pub use item::InboxItem;
+pub use read_state::InboxReadState;
+pub use resolver::ThreadResolver;

crates/signed_core/src/inbox/read_state.rs

@@ -0,0 +1,109 @@
+use std::collections::{HashMap, HashSet};
+use std::time::Duration;
+
+use nostr::prelude::*;
+use serde::{Deserialize, Serialize};
+
+const ADVANCE_WINDOW: Duration = Duration::from_secs(3 * 24 * 60 * 60);
+const MARK_ALL_WINDOW: Duration = Duration::from_secs(10 * 24 * 60 * 60);
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InboxReadState {
+    #[serde(default)]
+    pub read_before: Timestamp,
+    #[serde(default)]
+    pub read_ids: HashSet<EventId>,
+    #[serde(default)]
+    pub archived_before: Timestamp,
+    #[serde(default)]
+    pub archived_ids: HashSet<EventId>,
+}
+
+impl InboxReadState {
+    /// Returns whether the event falls under the read high-water mark or id set.
+    pub fn is_read(&self, event: &Event) -> bool {
+        event.created_at <= self.read_before || self.read_ids.contains(&event.id)
+    }
+
+    /// Returns whether the event falls under the archived high-water mark or id set.
+    pub fn is_archived(&self, event: &Event) -> bool {
+        event.created_at <= self.archived_before || self.archived_ids.contains(&event.id)
+    }
+
+    /// Records the event as read when it is past the current cutoff.
+    pub fn mark_read(&mut self, event: &Event) {
+        if event.created_at > self.read_before {
+            self.read_ids.insert(event.id);
+        }
+    }
+
+    /// Records the event as archived when it is past the current cutoff.
+    pub fn mark_archived(&mut self, event: &Event) {
+        if event.created_at > self.archived_before {
+            self.archived_ids.insert(event.id);
+        }
+    }
+
+    /// Marks all events from other authors within the window as read.
+    pub fn mark_all_read(&mut self, all: &[Event], me: PublicKey, now: Timestamp) {
+        let cutoff = now - MARK_ALL_WINDOW;
+        self.read_before = cutoff;
+        self.read_ids = all
+            .iter()
+            .filter(|event| event.pubkey != me && event.created_at > cutoff)
+            .map(|event| event.id)
+            .collect();
+    }
+
+    /// Advances the read cutoff as far as possible, then prunes the id set.
+    pub fn advance_read(&mut self, all: &[Event], me: PublicKey, now: Timestamp) {
+        let cutoff = advance_cutoff(all, me, now, self.read_before, |event| self.is_read(event));
+        self.read_before = cutoff;
+        prune_ids(&mut self.read_ids, all, cutoff);
+    }
+
+    /// Advances the archived cutoff as far as possible, then prunes the id set.
+    pub fn advance_archived(&mut self, all: &[Event], me: PublicKey, now: Timestamp) {
+        let cutoff = advance_cutoff(all, me, now, self.archived_before, |event| {
+            self.is_archived(event)
+        });
+        self.archived_before = cutoff;
+        prune_ids(&mut self.archived_ids, all, cutoff);
+    }
+}
+
+/// Computes the newest cutoff that leaves unmarked events uncovered.
+fn advance_cutoff<M>(
+    all: &[Event],
+    me: PublicKey,
+    now: Timestamp,
+    current: Timestamp,
+    is_marked: M,
+) -> Timestamp
+where
+    M: Fn(&Event) -> bool,
+{
+    let fallback = now - ADVANCE_WINDOW;
+
+    let oldest = all
+        .iter()
+        .filter(|event| event.pubkey != me && !is_marked(event))
+        .map(|event| event.created_at)
+        .min();
+
+    let candidate = match oldest {
+        Some(at) if at < fallback => at - 1,
+        _ => fallback,
+    };
+
+    candidate.max(current)
+}
+
+/// Drops ids whose events predate the cutoff.
+fn prune_ids(ids: &mut HashSet<EventId>, all: &[Event], cutoff: Timestamp) {
+    let created_at: HashMap<EventId, Timestamp> = all
+        .iter()
+        .map(|event| (event.id, event.created_at))
+        .collect();
+    ids.retain(|id| created_at.get(id).is_some_and(|at| *at >= cutoff));
+}

crates/signed_core/src/inbox/resolver.rs

@@ -0,0 +1,249 @@
+use std::collections::HashSet;
+
+use nostr::prelude::*;
+
+pub struct ThreadResolver<'a, L: ?Sized> {
+    lookup: &'a L,
+}
+
+impl<'a, L> ThreadResolver<'a, L>
+where
+    L: Fn(EventId) -> Option<Event> + ?Sized,
+{
+    /// Creates a resolver over the given event lookup.
+    pub fn new(lookup: &'a L) -> Self {
+        Self { lookup }
+    }
+
+    /// Maps a git event kind to the thread root it notifies about.
+    pub fn notification_root(&self, event: &Event) -> Option<EventId> {
+        match event.kind {
+            Kind::GitIssue | Kind::GitPullRequest => Some(event.id),
+            Kind::GitPatch => Some(match self.first_e_id(event) {
+                Some(parent) => self.resolve_thread_root(parent),
+                None => event.id,
+            }),
+            Kind::Comment => match nip22::extract_root(event) {
+                Some(CommentTarget::Event { id, .. }) => Some(self.resolve_thread_root(id)),
+                _ => None,
+            },
+            Kind::GitPullRequestUpdate => self
+                .first_uppercase_e_id(event)
+                .map(|root| self.resolve_thread_root(root)),
+            Kind::GitStatusOpen
+            | Kind::GitStatusApplied
+            | Kind::GitStatusClosed
+            | Kind::GitStatusDraft => self
+                .nip10_root_id(event)
+                .map(|root| self.resolve_thread_root(root)),
+            _ => None,
+        }
+    }
+
+    /// Follows parent pointers until a git issue or pull request root is reached.
+    pub fn resolve_thread_root(&self, id: EventId) -> EventId {
+        let mut seen = HashSet::new();
+        let mut root = id;
+
+        loop {
+            if !seen.insert(root) {
+                return id;
+            }
+
+            let Some(event) = (self.lookup)(root) else {
+                return root;
+            };
+
+            if matches!(event.kind, Kind::GitIssue | Kind::GitPullRequest) {
+                return root;
+            }
+
+            match self.parent_id(&event) {
+                Some(parent) => root = parent,
+                None => return root,
+            }
+        }
+    }
+
+    /// Mirrors gitworkshop's `getParentId` parent resolution.
+    fn parent_id(&self, event: &Event) -> Option<EventId> {
+        for marker in ["reply", "root"] {
+            if let Some(id) = event
+                .tags
+                .iter()
+                .find_map(|tag| self.e_tag_with_marker(tag, marker))
+            {
+                return Some(id);
+            }
+        }
+
+        if let Some(id) = event.tags.iter().find_map(|tag| {
+            if tag.kind() != "e" {
+                return None;
+            }
+
+            let slice = tag.as_slice();
+            let is_mention = slice.len() == 4 && slice[3] == "mention";
+
+            if is_mention {
+                return None;
+            }
+
+            tag.content()
+                .and_then(|content| EventId::from_hex(content).ok())
+        }) {
+            return Some(id);
+        }
+
+        self.first_uppercase_e_id(event)
+    }
+
+    /// Reads the NIP-10 `root` marker, falling back to the first `e` tag.
+    fn nip10_root_id(&self, event: &Event) -> Option<EventId> {
+        event
+            .tags
+            .iter()
+            .find_map(|tag| self.e_tag_with_marker(tag, "root"))
+            .or_else(|| self.first_e_id(event))
+    }
+
+    /// Reads the first lowercase `e` tag id.
+    fn first_e_id(&self, event: &Event) -> Option<EventId> {
+        self.first_tag_id(event, "e")
+    }
+
+    /// Reads the first uppercase `E` tag id.
+    fn first_uppercase_e_id(&self, event: &Event) -> Option<EventId> {
+        self.first_tag_id(event, "E")
+    }
+
+    /// Reads the first event id from tags of the given kind.
+    fn first_tag_id(&self, event: &Event, name: &str) -> Option<EventId> {
+        event.tags.iter().find_map(|tag| {
+            if tag.kind() != name {
+                return None;
+            }
+            tag.content()
+                .and_then(|content| EventId::from_hex(content).ok())
+        })
+    }
+
+    /// Parses a four-value `e` tag carrying the given marker.
+    fn e_tag_with_marker(&self, tag: &Tag, marker: &str) -> Option<EventId> {
+        let slice = tag.as_slice();
+        if tag.kind() != "e" || slice.len() != 4 || slice[3] != marker {
+            return None;
+        }
+        tag.content()
+            .and_then(|content| EventId::from_hex(content).ok())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Derives deterministic signer keys from a seed byte.
+    fn keys(seed: u8) -> Keys {
+        let mut hex = "00000000000000000000000000000000000000000000000000000000000000".to_string();
+        hex.push_str(&format!("{seed:02x}"));
+        Keys::new(SecretKey::from_hex(&hex).expect("valid secret key"))
+    }
+
+    /// Builds a signed event with a fixed timestamp.
+    fn signed(author: &Keys, kind: Kind, tags: Vec<Tag>, created_at: u64) -> Event {
+        EventBuilder::new(kind, "")
+            .tags(tags)
+            .custom_created_at(Timestamp::from_secs(created_at))
+            .finalize(author)
+            .expect("signed event")
+    }
+
+    /// Builds a plain lowercase `e` tag for the event.
+    fn e_tag(event: &Event) -> Tag {
+        Tag::parse(["e", &event.id.to_hex()]).expect("valid e tag")
+    }
+
+    /// Builds a four-value `e` tag with the given marker.
+    fn marked_e_tag(event: &Event, marker: &str) -> Tag {
+        Tag::parse(["e", &event.id.to_hex(), "wss://relay.example.com", marker])
+            .expect("valid e tag")
+    }
+
+    /// Builds an uppercase `E` tag for the event.
+    fn uppercase_e_tag(event: &Event) -> Tag {
+        Tag::parse(["E", &event.id.to_hex()]).expect("valid E tag")
+    }
+
+    /// Builds an event lookup closure over a slice.
+    fn lookup(events: &[Event]) -> impl Fn(EventId) -> Option<Event> + '_ {
+        move |id| events.iter().find(|event| event.id == id).cloned()
+    }
+
+    /// Builds a git issue event.
+    fn issue(author: &Keys, at: u64) -> Event {
+        signed(author, Kind::GitIssue, Vec::new(), at)
+    }
+
+    /// Resolves a comment to its uppercase `E` root.
+    #[test]
+    fn comment_resolves_to_its_uppercase_root() {
+        let issue = issue(&keys(1), 100);
+        let comment = signed(
+            &keys(2),
+            Kind::Comment,
+            vec![
+                uppercase_e_tag(&issue),
+                Tag::parse(["K", "1621"]).expect("valid K tag"),
+            ],
+            200,
+        );
+        let events = [issue.clone(), comment.clone()];
+        assert_eq!(
+            ThreadResolver::new(&lookup(&events)).notification_root(&comment),
+            Some(issue.id)
+        );
+    }
+
+    /// Resolves a child patch to its root patch.
+    #[test]
+    fn child_patch_resolves_to_the_root_patch() {
+        let root_patch = signed(&keys(1), Kind::GitPatch, Vec::new(), 100);
+        let child_patch = signed(&keys(1), Kind::GitPatch, vec![e_tag(&root_patch)], 200);
+        let events = [root_patch.clone(), child_patch.clone()];
+        assert_eq!(
+            ThreadResolver::new(&lookup(&events)).notification_root(&child_patch),
+            Some(root_patch.id)
+        );
+    }
+
+    /// Resolves a status through its `root` marker tag.
+    #[test]
+    fn status_resolves_via_the_root_marker() {
+        let issue = issue(&keys(1), 100);
+        let status = signed(
+            &keys(2),
+            Kind::GitStatusClosed,
+            vec![marked_e_tag(&issue, "root")],
+            200,
+        );
+        let events = [issue.clone(), status.clone()];
+        assert_eq!(
+            ThreadResolver::new(&lookup(&events)).notification_root(&status),
+            Some(issue.id)
+        );
+    }
+
+    /// Follows a nested comment chain to the issue root.
+    #[test]
+    fn nested_comment_chain_follows_to_the_root() {
+        let issue = issue(&keys(1), 100);
+        let reply = signed(&keys(2), Kind::Comment, vec![uppercase_e_tag(&issue)], 200);
+        let nested = signed(&keys(3), Kind::Comment, vec![uppercase_e_tag(&reply)], 300);
+        let events = [issue.clone(), reply, nested.clone()];
+        assert_eq!(
+            ThreadResolver::new(&lookup(&events)).notification_root(&nested),
+            Some(issue.id)
+        );
+    }
+}

crates/signed_core/src/lib.rs

@@ -1,18 +1,19 @@
 pub mod addr;
-pub mod annotations;
-pub mod clone_url;
-pub mod comments;
+pub mod announcement;
 pub mod deletions;
 pub mod filters;
-pub mod model;
-pub mod state;
+pub mod git_event;
+pub mod inbox;
+pub mod pull_request;
 pub mod status;
+pub mod upstream;
 
-pub use addr::{RepoAddr, identifier_from_name, repo_addr};
-pub use annotations::{COVER_NOTE_KIND, cover_note, labels_and_subject, subject_override};
-pub use clone_url::{CloneTarget, parse_clone_url};
-pub use comments::{CommentThread, comment_threads};
+pub use addr::RepoAddr;
+pub use announcement::Announcement;
 pub use deletions::Deletions;
-pub use model::{Announcement, activity_subject, pull_request_patch};
-pub use state::{build_state, parse_state};
-pub use status::{RepoStatus, references_root, resolve_status};
+pub use filters::Filters;
+pub use git_event::GitEvent;
+pub use inbox::{InboxItem, InboxReadState, ThreadResolver};
+pub use pull_request::PullRequest;
+pub use status::RepoStatus;
+pub use upstream::Upstream;

crates/signed_core/src/model.rs

@@ -1,565 +0,0 @@
-use std::collections::HashSet;
-
-use gpui::SharedString;
-use nostr::prelude::*;
-
-/// Parsed NIP-34 repository announcement (plain data, ready for the UI).
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Announcement {
-    /// ID of the announcement event itself.
-    pub event_id: EventId,
-    /// Repository ID (`d` tag).
-    pub id: String,
-    /// Author of the announcement event.
-    pub owner: PublicKey,
-    /// When the announcement was published (for latest-wins resolution).
-    pub created_at: Timestamp,
-    pub name: Option<SharedString>,
-    pub description: Option<SharedString>,
-    /// Webpage URLs for browsing.
-    pub web: Vec<Url>,
-    /// URLs for `git clone`.
-    pub clone: Vec<Url>,
-    /// Relays the repository monitors for patches and issues.
-    pub relays: Vec<RelayUrl>,
-    /// Earliest unique commit ID (`r` tag with `euc` marker).
-    pub euc: Option<String>,
-    /// Other recognized maintainers.
-    pub maintainers: Vec<PublicKey>,
-    /// Value of a `u` tag, if any: this repository is a subordinate fork of
-    /// the referenced upstream (NIP-34).
-    pub upstream: Option<String>,
-    /// Hashtags labelling the repository (`t` tags).
-    pub hashtags: Vec<String>,
-}
-
-/// Subject of a NIP-34 issue or pull request event: the `subject` tag,
-/// falling back to the first non-empty line of the content.
-pub fn activity_subject(event: &Event) -> SharedString {
-    let subject = event
-        .tags
-        .iter()
-        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
-            Ok(Nip34Tag::Subject(subject)) => Some(subject),
-            _ => None,
-        });
-
-    subject
-        .map(SharedString::from)
-        .or_else(|| {
-            event
-                .content
-                .lines()
-                .map(str::trim)
-                .find(|line| !line.is_empty())
-                .map(SharedString::from)
-        })
-        .unwrap_or(SharedString::from("Untitled"))
-}
-
-/// The patch set of a pull request: the root patch event (kind `1617`) the
-/// PR references via its `e` tag, plus every patch of the set chained to it
-/// with NIP-10 `e` reply tags, in series order (oldest first). When the PR
-/// has no `e` tag, falls back to the patch producing the PR's tip commit
-/// (its `commit`/`r` tag, per NIP-34) and walks the reply chain backward to
-/// the root.
-///
-/// Returns an empty list when no patch event can be linked to the PR.
-pub fn pull_request_patches<'a>(
-    pr: &Event,
-    patches: impl IntoIterator<Item = &'a Event>,
-) -> Vec<&'a Event> {
-    let patches: Vec<&'a Event> = patches.into_iter().collect();
-
-    // The PR references its root patch via an `e` tag; follow the NIP-10
-    // reply chain forward from there (each patch of the set replies to the
-    // previous one). Among several replies (a revision), the newest wins.
-    if let Some(root_id) = pr.tags.event_ids().next()
-        && let Some(root) = patches.iter().find(|patch| patch.id == root_id)
-    {
-        return forward_series(root, &patches);
-    }
-
-    // No `e` tag: the last patch of the set carries the PR's tip commit in
-    // its `commit`/`r` tag; walk the reply chain backward to the root.
-    let Some(tip) = current_commit_of(pr) else {
-        return Vec::new();
-    };
-    let Some(last) = patches
-        .iter()
-        .filter(|patch| patch_produces_commit(patch, &tip))
-        .max_by_key(|patch| patch.created_at)
-        .copied()
-    else {
-        return Vec::new();
-    };
-
-    let mut series = vec![last];
-    loop {
-        let Some(prev_id) = series.last().unwrap().tags.event_ids().next() else {
-            break;
-        };
-        let Some(prev) = patches
-            .iter()
-            .find(|patch| patch.id == prev_id && !series.contains(patch))
-            .copied()
-        else {
-            break;
-        };
-        series.push(prev);
-    }
-    series.reverse();
-    series
-}
-
-/// The patch content of a pull request: the contents of every patch event of
-/// its patch set (see [`pull_request_patches`]) joined in series order,
-/// falling back to the PR's own content for older PRs that carried the
-/// patch inline.
-pub fn pull_request_patch<'a>(pr: &Event, patches: impl IntoIterator<Item = &'a Event>) -> String {
-    let patches: Vec<&'a Event> = patches.into_iter().collect();
-    let series = pull_request_patches(pr, patches.iter().copied());
-    if series.is_empty() {
-        return pr.content.clone();
-    }
-    series
-        .iter()
-        .map(|patch| patch.content.as_str())
-        .collect::<Vec<_>>()
-        .join("\n")
-}
-
-/// The chain of patches replying to `root` (NIP-10 `e` tags), oldest first.
-fn forward_series<'a>(root: &'a Event, patches: &[&'a Event]) -> Vec<&'a Event> {
-    let mut series = vec![root];
-    loop {
-        let next = patches
-            .iter()
-            .filter(|patch| !series.contains(patch))
-            .filter(|patch| {
-                patch
-                    .tags
-                    .event_ids()
-                    .any(|id| id == series.last().unwrap().id)
-            })
-            .max_by_key(|patch| patch.created_at);
-        let Some(next) = next else {
-            break;
-        };
-        series.push(next);
-    }
-    series
-}
-
-/// The `c` tag of an event (tip of the proposed branch), as hex.
-fn current_commit_of(event: &Event) -> Option<String> {
-    event
-        .tags
-        .iter()
-        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
-            Ok(Nip34Tag::CurrentCommit(commit)) => Some(commit.to_string()),
-            _ => None,
-        })
-}
-
-/// Whether `patch` produces `commit` (its `commit` or `r` tag), so clients
-/// can find existing patches for a specific commit.
-fn patch_produces_commit(patch: &Event, commit: &str) -> bool {
-    patch
-        .tags
-        .iter()
-        .any(|tag| match Nip34Tag::parse(tag.as_slice()) {
-            Ok(Nip34Tag::Commit(c) | Nip34Tag::Reference(c)) => c.to_string() == commit,
-            _ => false,
-        })
-}
-
-impl Announcement {
-    /// Parse a kind `30617` event. Returns `None` if the kind is wrong or the `d` tag is missing.
-    pub fn from_event(event: &Event) -> Option<Self> {
-        if event.kind != Kind::GitRepoAnnouncement {
-            return None;
-        }
-
-        let id = event.tags.identifier()?;
-
-        let mut hashtags: Vec<String> = Vec::new();
-        hashtags.extend(event.tags.hashtags().map(|t| t.to_string()));
-
-        let mut name: Option<SharedString> = None;
-        let mut description: Option<SharedString> = None;
-        let mut web: Vec<Url> = Vec::new();
-        let mut clone: Vec<Url> = Vec::new();
-        let mut relays: Vec<RelayUrl> = Vec::new();
-        let mut euc: Option<String> = None;
-        let mut maintainers: Vec<PublicKey> = Vec::new();
-        let mut upstream: Option<String> = None;
-
-        for tag in event.tags.iter() {
-            match Nip34Tag::parse(tag.as_slice()) {
-                Ok(Nip34Tag::Name(value)) => name = Some(value.into()),
-                Ok(Nip34Tag::Description(value)) => description = Some(value.into()),
-                Ok(Nip34Tag::Web(urls)) => web.extend(urls),
-                Ok(Nip34Tag::Clone(urls)) => clone.extend(urls),
-                Ok(Nip34Tag::Relays(urls)) => relays.extend(urls),
-                Ok(Nip34Tag::EarliestUniqueCommitId(commit)) => euc = Some(commit.to_string()),
-                Ok(Nip34Tag::Maintainers(keys)) => maintainers.extend(keys),
-                _ => {}
-            }
-
-            // The `u` tag is not modelled by the SDK's `Nip34Tag`; parse it
-            // manually (first value wins).
-            if upstream.is_none() && tag.kind() == "u" {
-                upstream = tag.content().map(str::to_owned);
-            }
-        }
-
-        Some(Self {
-            event_id: event.id,
-            owner: event.pubkey,
-            created_at: event.created_at,
-            id,
-            name,
-            description,
-            web,
-            clone,
-            relays,
-            euc,
-            maintainers,
-            upstream,
-            hashtags,
-        })
-    }
-
-    /// The repository address of this announcement.
-    pub fn addr(&self) -> crate::RepoAddr {
-        crate::repo_addr(self.owner, self.id.clone())
-    }
-
-    /// The description of the repository, or a default if none is provided.
-    pub fn description(&self) -> SharedString {
-        self.description
-            .clone()
-            .unwrap_or(SharedString::from("No description"))
-    }
-
-    /// The effective maintainers of this repository: the announced
-    /// `maintainers` plus the announcement author, who asserts themselves as
-    /// a maintainer of the primary project unless a `u` tag marks this
-    /// repository as a subordinate fork (NIP-34).
-    pub fn effective_maintainers(&self) -> Vec<PublicKey> {
-        let mut maintainers = self.maintainers.clone();
-        if self.upstream.is_none() && !maintainers.contains(&self.owner) {
-            maintainers.push(self.owner);
-        }
-        maintainers
-    }
-
-    /// The `git clone` URLs for this repository, deduplicated while
-    /// preserving the announced order (deterministic across calls).
-    pub fn clone_urls(&self) -> Vec<SharedString> {
-        let mut seen = HashSet::new();
-        self.clone
-            .iter()
-            .map(|url| SharedString::from(format!("git clone {url}")))
-            .filter(|command| seen.insert(command.clone()))
-            .collect()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const MAINTAINER_HEX: &str = "68d81165918100b7da43fc28f7d1fc12554466e1115886b9e7bb326f65ec4272";
-
-    fn keys() -> Keys {
-        Keys::new(
-            SecretKey::from_hex("0000000000000000000000000000000000000000000000000000000000000001")
-                .expect("valid secret key"),
-        )
-    }
-
-    /// Build a signed kind `30617` event from raw tag values.
-    fn announcement_event(tags: &[&[&str]]) -> Event {
-        let tags: Vec<Tag> = tags
-            .iter()
-            .map(|t| Tag::parse(t.to_vec()).expect("valid tag"))
-            .collect();
-
-        EventBuilder::new(Kind::GitRepoAnnouncement, "")
-            .tags(tags)
-            .finalize(&keys())
-            .expect("signed event")
-    }
-
-    #[test]
-    fn parses_full_announcement() {
-        let event = announcement_event(&[
-            &["d", "my-repo"],
-            &["name", "My Repo"],
-            &["description", "A test repository"],
-            &["web", "https://example.com/repo"],
-            &["clone", "https://example.com/repo.git"],
-            &["relays", "wss://relay.example.com"],
-            &["r", "aa231c4c6a5777dc89b42207b499891a344add5c", "euc"],
-            &["maintainers", MAINTAINER_HEX],
-            &["t", "rust"],
-            &["t", "nostr"],
-        ]);
-
-        let announcement = Announcement::from_event(&event).expect("parses");
-
-        assert_eq!(announcement.owner, keys().public_key());
-        assert_eq!(announcement.id, "my-repo");
-        assert_eq!(announcement.name.as_deref(), Some("My Repo"));
-        assert_eq!(
-            announcement.description.as_deref(),
-            Some("A test repository")
-        );
-        assert_eq!(
-            announcement.web,
-            vec![Url::parse("https://example.com/repo").unwrap()]
-        );
-        assert_eq!(
-            announcement.clone,
-            vec![Url::parse("https://example.com/repo.git").unwrap()]
-        );
-        assert_eq!(
-            announcement.relays,
-            vec![RelayUrl::parse("wss://relay.example.com").unwrap()]
-        );
-        assert_eq!(
-            announcement.euc.as_deref(),
-            Some("aa231c4c6a5777dc89b42207b499891a344add5c")
-        );
-        assert_eq!(
-            announcement.maintainers,
-            vec![PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey")]
-        );
-        assert_eq!(announcement.hashtags, vec!["rust", "nostr"]);
-    }
-
-    #[test]
-    fn requires_d_tag() {
-        let event = announcement_event(&[&["name", "No id"]]);
-
-        assert!(Announcement::from_event(&event).is_none());
-    }
-
-    #[test]
-    fn ignores_other_kinds() {
-        let event = EventBuilder::new(Kind::GitIssue, "")
-            .finalize(&keys())
-            .expect("signed event");
-
-        assert!(Announcement::from_event(&event).is_none());
-    }
-
-    #[test]
-    fn drops_malformed_values() {
-        let event = announcement_event(&[
-            &["d", "my-repo"],
-            &["clone", "not a url"],
-            &["relays", "wss://good.example.com"],
-            &["maintainers", "not-a-pubkey"],
-        ]);
-
-        let announcement = Announcement::from_event(&event).expect("parses");
-
-        // An invalid URL keeps the whole clone tag from being parsed.
-        assert!(announcement.clone.is_empty());
-        assert_eq!(
-            announcement.relays,
-            vec![RelayUrl::parse("wss://good.example.com").unwrap()]
-        );
-        assert!(announcement.maintainers.is_empty());
-    }
-
-    #[test]
-    fn ignores_unknown_tags() {
-        let event = announcement_event(&[&["d", "my-repo"], &["t", "label"], &["subject", "n/a"]]);
-
-        let announcement = Announcement::from_event(&event).expect("parses");
-
-        assert_eq!(announcement.id, "my-repo");
-        assert!(announcement.name.is_none());
-        assert!(announcement.web.is_empty());
-    }
-
-    #[test]
-    fn parses_upstream_tag() {
-        let event = announcement_event(&[
-            &["d", "my-fork"],
-            &["u", "30617:abc:upstream|https://example.com/upstream.git"],
-        ]);
-
-        let announcement = Announcement::from_event(&event).expect("parses");
-
-        assert_eq!(
-            announcement.upstream.as_deref(),
-            Some("30617:abc:upstream|https://example.com/upstream.git")
-        );
-    }
-
-    #[test]
-    fn effective_maintainers_include_owner_for_primary_repos() {
-        let event = announcement_event(&[&["d", "my-repo"], &["maintainers", MAINTAINER_HEX]]);
-
-        let announcement = Announcement::from_event(&event).expect("parses");
-        let maintainers = announcement.effective_maintainers();
-
-        // The owner asserts themselves as a maintainer of the primary
-        // project (NIP-34), alongside the announced co-maintainers.
-        assert_eq!(maintainers.len(), 2);
-        assert!(maintainers.contains(&announcement.owner));
-        assert!(maintainers.contains(&PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey")));
-    }
-
-    #[test]
-    fn effective_maintainers_exclude_owner_for_subordinate_forks() {
-        let event = announcement_event(&[
-            &["d", "my-fork"],
-            &["u", "30617:abc:upstream|https://example.com/upstream.git"],
-            &["maintainers", MAINTAINER_HEX],
-        ]);
-
-        let announcement = Announcement::from_event(&event).expect("parses");
-        let maintainers = announcement.effective_maintainers();
-
-        // A `u` tag marks the repository as a subordinate fork: the author
-        // is not a maintainer of the primary project (NIP-34).
-        assert!(!maintainers.contains(&announcement.owner));
-        assert_eq!(
-            maintainers,
-            vec![PublicKey::from_hex(MAINTAINER_HEX).expect("valid pubkey")]
-        );
-    }
-
-    /// Build a signed PR event with the given tags and content.
-    fn pr_event(content: &str, tags: Vec<Tag>) -> Event {
-        EventBuilder::new(Kind::GitPullRequest, content)
-            .tags(tags)
-            .finalize(&keys())
-            .expect("signed event")
-    }
-
-    #[test]
-    fn pull_request_patch_prefers_linked_patch_event() {
-        let patch = EventBuilder::new(Kind::GitPatch, "patch-content")
-            .finalize(&keys())
-            .expect("signed event");
-        let pr = pr_event("description", vec![Tag::event(patch.id)]);
-
-        assert_eq!(pull_request_patch(&pr, [&patch]), "patch-content");
-    }
-
-    #[test]
-    fn pull_request_patch_falls_back_to_inline_content() {
-        // Older PRs carried the patch in the content; no linked patch event.
-        let pr = pr_event("patch-inline", vec![]);
-
-        assert_eq!(pull_request_patch(&pr, [] as [&Event; 0]), "patch-inline");
-    }
-
-    #[test]
-    fn pull_request_patch_ignores_unrelated_patch_events() {
-        let patch = EventBuilder::new(Kind::GitPatch, "patch-content")
-            .finalize(&keys())
-            .expect("signed event");
-        let pr = pr_event("description", vec![]);
-
-        assert_eq!(pull_request_patch(&pr, [&patch]), "description");
-    }
-
-    /// Build a signed patch event with a controlled `created_at`.
-    fn patch_event(content: &str, tags: Vec<Tag>, created_at: u64) -> Event {
-        EventBuilder::new(Kind::GitPatch, content)
-            .tags(tags)
-            .custom_created_at(Timestamp::from(created_at))
-            .finalize(&keys())
-            .expect("signed event")
-    }
-
-    #[test]
-    fn pull_request_patch_joins_the_whole_patch_set() {
-        // NIP-34: a PR references the root patch; later patches of the set
-        // reply to the previous one (NIP-10 `e` tags).
-        let root = patch_event("patch-one", vec![], 100);
-        let second = patch_event("patch-two", vec![Tag::event(root.id)], 200);
-        let pr = pr_event("description", vec![Tag::event(root.id)]);
-
-        assert_eq!(
-            pull_request_patch(&pr, [&root, &second]),
-            "patch-one\npatch-two"
-        );
-        assert_eq!(
-            pull_request_patches(&pr, [&root, &second]),
-            vec![&root, &second]
-        );
-    }
-
-    #[test]
-    fn pull_request_patches_walks_the_reply_chain_in_order() {
-        let root = patch_event("patch-one", vec![], 100);
-        let second = patch_event("patch-two", vec![Tag::event(root.id)], 200);
-        let third = patch_event("patch-three", vec![Tag::event(second.id)], 300);
-        let pr = pr_event("description", vec![Tag::event(root.id)]);
-
-        let series = pull_request_patches(&pr, [&third, &root, &second]);
-        assert_eq!(
-            series
-                .iter()
-                .map(|p| p.content.as_str())
-                .collect::<Vec<_>>(),
-            vec!["patch-one", "patch-two", "patch-three"]
-        );
-    }
-
-    #[test]
-    fn pull_request_patches_ignores_unrelated_replies() {
-        let root = patch_event("patch-one", vec![], 100);
-        let other = patch_event("other-patch", vec![Tag::event(root.id)], 250);
-        // A patch replying to a different root is not part of the set.
-        let stranger = patch_event("stranger", vec![], 150);
-        let pr = pr_event("description", vec![Tag::event(root.id)]);
-
-        let series = pull_request_patches(&pr, [&root, &other, &stranger]);
-        assert_eq!(
-            series
-                .iter()
-                .map(|p| p.content.as_str())
-                .collect::<Vec<_>>(),
-            vec!["patch-one", "other-patch"]
-        );
-    }
-
-    #[test]
-    fn pull_request_patches_finds_the_set_via_the_tip_commit() {
-        // PRs without an `e` tag: the last patch of the set carries the tip
-        // commit in its `r` tag; walk the reply chain backward to the root.
-        let root = patch_event("patch-one", vec![], 100);
-        let tip = "1111111111111111111111111111111111111111";
-        let last = patch_event(
-            "patch-two",
-            vec![
-                Tag::event(root.id),
-                Tag::parse(["r", tip]).expect("valid tag"),
-            ],
-            200,
-        );
-        let pr = pr_event(
-            "description",
-            vec![Tag::parse(["c", tip]).expect("valid tag")],
-        );
-
-        let series = pull_request_patches(&pr, [&root, &last]);
-        assert_eq!(
-            series
-                .iter()
-                .map(|p| p.content.as_str())
-                .collect::<Vec<_>>(),
-            vec!["patch-one", "patch-two"]
-        );
-    }
-}

crates/signed_core/src/pull_request.rs

@@ -0,0 +1,279 @@
+use nostr::prelude::*;
+
+use crate::git_event::GitEvent;
+
+pub struct PullRequest<'a>(pub &'a Event);
+
+impl<'a> PullRequest<'a> {
+    /// Wraps a pull request root event.
+    pub fn new(event: &'a Event) -> Self {
+        Self(event)
+    }
+
+    /// Returns the ordered patch series, found via the root reference or the tip commit.
+    pub fn patches(&self, patches: impl IntoIterator<Item = &'a Event>) -> Vec<&'a Event> {
+        let pr = self.0;
+        let patches: Vec<&'a Event> = patches.into_iter().collect();
+
+        if let Some(root_id) = pr.tags.event_ids().next()
+            && let Some(root) = patches.iter().find(|patch| patch.id == root_id)
+        {
+            return Self::forward_series(root, &patches);
+        }
+
+        let Some(tip) = pr.current_commit() else {
+            return Vec::new();
+        };
+        let Some(last) = patches
+            .iter()
+            .filter(|patch| Self::patch_produces_commit(patch, &tip))
+            .max_by_key(|patch| patch.created_at)
+            .copied()
+        else {
+            return Vec::new();
+        };
+
+        let mut series = vec![last];
+        loop {
+            let Some(prev_id) = series.last().unwrap().tags.event_ids().next() else {
+                break;
+            };
+            let Some(prev) = patches
+                .iter()
+                .find(|patch| patch.id == prev_id && !series.contains(patch))
+                .copied()
+            else {
+                break;
+            };
+            series.push(prev);
+        }
+        series.reverse();
+        series
+    }
+
+    /// Joins the patch series with newlines, falling back to the event content.
+    pub fn patch(&self, patches: impl IntoIterator<Item = &'a Event>) -> String {
+        let pr = self.0;
+        let patches: Vec<&'a Event> = patches.into_iter().collect();
+        let series = self.patches(patches.iter().copied());
+        if series.is_empty() {
+            return pr.content.clone();
+        }
+        series
+            .iter()
+            .map(|patch| patch.content.as_str())
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+
+    /// Returns the root author's newest update, since only the author may move the tip.
+    pub fn latest_update(
+        events: impl Iterator<Item = &'a Event>,
+        root: &Event,
+    ) -> Option<&'a Event> {
+        let root_hex = root.id.to_hex();
+        events
+            .filter(|e| e.kind == Kind::GitPullRequestUpdate)
+            .filter(|e| e.pubkey == root.pubkey)
+            .filter(|e| {
+                e.tags
+                    .iter()
+                    .any(|t| t.kind() == "E" && t.content() == Some(root_hex.as_str()))
+            })
+            .max_by_key(|e| e.created_at)
+    }
+
+    /// Walks reply links outward from the root patch, taking the newest child first.
+    fn forward_series(root: &'a Event, patches: &[&'a Event]) -> Vec<&'a Event> {
+        let mut series = vec![root];
+        loop {
+            let next = patches
+                .iter()
+                .filter(|patch| !series.contains(patch))
+                .filter(|patch| {
+                    patch
+                        .tags
+                        .event_ids()
+                        .any(|id| id == series.last().unwrap().id)
+                })
+                .max_by_key(|patch| patch.created_at);
+            let Some(next) = next else {
+                break;
+            };
+            series.push(next);
+        }
+        series
+    }
+
+    /// Checks the commit against the patch's `c` and `r` tags.
+    fn patch_produces_commit(patch: &Event, commit: &str) -> bool {
+        patch
+            .tags
+            .iter()
+            .any(|tag| match Nip34Tag::parse(tag.as_slice()) {
+                Ok(Nip34Tag::Commit(c) | Nip34Tag::Reference(c)) => c.to_string() == commit,
+                _ => false,
+            })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Returns the test signer keys.
+    fn keys() -> Keys {
+        Keys::new(
+            SecretKey::from_hex("0000000000000000000000000000000000000000000000000000000000000001")
+                .expect("valid secret key"),
+        )
+    }
+
+    /// Builds a signed pull request event.
+    fn pr_event(content: &str, tags: Vec<Tag>) -> Event {
+        EventBuilder::new(Kind::GitPullRequest, content)
+            .tags(tags)
+            .finalize(&keys())
+            .expect("signed event")
+    }
+
+    /// Builds a signed patch event with a fixed timestamp.
+    fn patch_event(content: &str, tags: Vec<Tag>, created_at: u64) -> Event {
+        EventBuilder::new(Kind::GitPatch, content)
+            .tags(tags)
+            .custom_created_at(Timestamp::from(created_at))
+            .finalize(&keys())
+            .expect("signed event")
+    }
+
+    /// Joins the full patch series into one diff.
+    #[test]
+    fn pull_request_patch_joins_the_whole_patch_set() {
+        let root = patch_event("patch-one", vec![], 100);
+        let second = patch_event("patch-two", vec![Tag::event(root.id)], 200);
+        let pr = pr_event("description", vec![Tag::event(root.id)]);
+
+        assert_eq!(
+            PullRequest::new(&pr).patch([&root, &second]),
+            "patch-one\npatch-two"
+        );
+        assert_eq!(
+            PullRequest::new(&pr).patches([&root, &second]),
+            vec![&root, &second]
+        );
+    }
+
+    /// Orders patches by walking the reply chain.
+    #[test]
+    fn pull_request_patches_walks_the_reply_chain_in_order() {
+        let root = patch_event("patch-one", vec![], 100);
+        let second = patch_event("patch-two", vec![Tag::event(root.id)], 200);
+        let third = patch_event("patch-three", vec![Tag::event(second.id)], 300);
+        let pr = pr_event("description", vec![Tag::event(root.id)]);
+
+        let series = PullRequest::new(&pr).patches([&third, &root, &second]);
+        assert_eq!(
+            series
+                .iter()
+                .map(|p| p.content.as_str())
+                .collect::<Vec<_>>(),
+            vec!["patch-one", "patch-two", "patch-three"]
+        );
+    }
+
+    /// Finds the patch series through the declared tip commit.
+    #[test]
+    fn pull_request_patches_finds_the_set_via_the_tip_commit() {
+        let root = patch_event("patch-one", vec![], 100);
+        let tip = "1111111111111111111111111111111111111111";
+        let last = patch_event(
+            "patch-two",
+            vec![
+                Tag::event(root.id),
+                Tag::parse(["r", tip]).expect("valid tag"),
+            ],
+            200,
+        );
+        let pr = pr_event(
+            "description",
+            vec![Tag::parse(["c", tip]).expect("valid tag")],
+        );
+
+        let series = PullRequest::new(&pr).patches([&root, &last]);
+        assert_eq!(
+            series
+                .iter()
+                .map(|p| p.content.as_str())
+                .collect::<Vec<_>>(),
+            vec!["patch-one", "patch-two"]
+        );
+    }
+
+    const COMMIT_HEX: &str = "1111111111111111111111111111111111111111";
+    const OTHER_ROOT_HEX: &str = "2222222222222222222222222222222222222222";
+
+    /// Builds a signed event with a fixed timestamp.
+    fn signed_at(kind: Kind, tags: Vec<Tag>, created_at: u64) -> Event {
+        EventBuilder::new(kind, "")
+            .tags(tags)
+            .custom_created_at(Timestamp::from(created_at))
+            .finalize(&keys())
+            .expect("signed event")
+    }
+
+    /// Builds the pull request root used by the update tests.
+    fn pr_root() -> Event {
+        signed_at(
+            Kind::GitPullRequest,
+            vec![
+                Tag::parse(["c", COMMIT_HEX]).expect("valid tag"),
+                Tag::parse(["branch-name", "feature/x"]).expect("valid tag"),
+            ],
+            100,
+        )
+    }
+
+    /// Picks the newest update targeting the root.
+    #[test]
+    fn latest_update_picks_newest_revision_of_the_root() {
+        let root = pr_root();
+        let root_hex = root.id.to_hex();
+
+        let revision = |created_at: u64| {
+            signed_at(
+                Kind::GitPullRequestUpdate,
+                vec![Tag::parse(["E", &root_hex]).expect("valid tag")],
+                created_at,
+            )
+        };
+        let unrelated = signed_at(
+            Kind::GitPullRequestUpdate,
+            vec![Tag::parse(["E", OTHER_ROOT_HEX]).expect("valid tag")],
+            999,
+        );
+
+        let events = [unrelated, revision(200), root.clone(), revision(300)];
+        let latest = PullRequest::latest_update(events.iter(), &root).expect("an update");
+
+        assert_eq!(latest.created_at.as_secs(), 300);
+        assert_eq!(latest.kind, Kind::GitPullRequestUpdate);
+    }
+
+    /// Ignores updates from authors other than the root owner.
+    #[test]
+    fn latest_update_ignores_other_authors() {
+        let root = pr_root();
+        let root_hex = root.id.to_hex();
+        let other = Keys::new(
+            SecretKey::from_hex("0000000000000000000000000000000000000000000000000000000000000002")
+                .expect("valid secret key"),
+        );
+        let stranger = EventBuilder::new(Kind::GitPullRequestUpdate, "")
+            .tags([Tag::parse(["E", &root_hex]).expect("valid tag")])
+            .custom_created_at(Timestamp::from(999))
+            .finalize(&other)
+            .expect("signed event");
+
+        assert!(PullRequest::latest_update([&stranger, &root].into_iter(), &root).is_none());
+    }
+}

crates/signed_core/src/state.rs

@@ -1,146 +0,0 @@
-use nostr::prelude::*;
-
-/// Build a kind `30618` repository state event from refs and HEAD.
-///
-/// `refs` are `(refname, commit-id)` pairs (e.g. `refs/heads/main`); `head`
-/// is the short branch name HEAD points to, published as
-/// `ref: refs/heads/<branch>`. The `d` tag matches the repository id.
-pub fn build_state(id: &str, refs: &[(String, String)], head: Option<&str>) -> EventBuilder {
-    let mut tags: Vec<Tag> = vec![Tag::identifier(id.to_owned())];
-    for (name, commit) in refs {
-        tags.push(Tag::parse([name.as_str(), commit.as_str()]).expect("valid ref tag"));
-    }
-    if let Some(head) = head {
-        tags.push(
-            Tag::parse(["HEAD", &format!("ref: refs/heads/{head}")]).expect("valid HEAD tag"),
-        );
-    }
-    EventBuilder::new(Kind::RepoState, "").tags(tags)
-}
-
-/// Parse a kind `30618` repository state event into refs and HEAD.
-///
-/// `refs` are `(refname, commit-id)` pairs; `head` is the branch pointed to
-/// by the `HEAD` tag, if any.
-pub fn parse_state(event: &Event) -> (Vec<(String, String)>, Option<String>) {
-    let mut refs = Vec::new();
-    let mut head = None;
-
-    for tag in event.tags.iter() {
-        match Nip34Tag::parse(tag.as_slice()) {
-            Ok(Nip34Tag::Head(branch)) => head = Some(branch),
-            Ok(Nip34Tag::RefHead { branch, commit }) => {
-                refs.push((format!("refs/heads/{branch}"), commit.to_string()));
-            }
-            Ok(Nip34Tag::RefTag { name, commit }) => {
-                refs.push((format!("refs/tags/{name}"), commit.to_string()));
-            }
-            _ => {}
-        }
-    }
-
-    (refs, head)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const COMMIT_A: &str = "aa231c4c6a5777dc89b42207b499891a344add5c";
-    const COMMIT_B: &str = "59429cfc6cb35b0a1ddace73b5a5c5ed57b8f5ca";
-
-    fn keys() -> Keys {
-        Keys::new(
-            SecretKey::from_hex("0000000000000000000000000000000000000000000000000000000000000001")
-                .expect("valid secret key"),
-        )
-    }
-
-    /// Build a signed kind `30618` event from raw tag values.
-    fn state_event(tags: &[&[&str]]) -> Event {
-        let tags: Vec<Tag> = tags
-            .iter()
-            .map(|t| Tag::parse(t.to_vec()).expect("valid tag"))
-            .collect();
-
-        EventBuilder::new(Kind::RepoState, "")
-            .tags(tags)
-            .finalize(&keys())
-            .expect("signed event")
-    }
-
-    #[test]
-    fn parses_heads_and_tags() {
-        let event = state_event(&[
-            &["HEAD", "ref: refs/heads/main"],
-            &["refs/heads/main", COMMIT_A],
-            &["refs/heads/dev", COMMIT_B],
-            &["refs/tags/v1.0", COMMIT_A],
-        ]);
-
-        let (refs, head) = parse_state(&event);
-
-        assert_eq!(head.as_deref(), Some("main"));
-        assert_eq!(
-            refs,
-            vec![
-                ("refs/heads/main".to_owned(), COMMIT_A.to_owned()),
-                ("refs/heads/dev".to_owned(), COMMIT_B.to_owned()),
-                ("refs/tags/v1.0".to_owned(), COMMIT_A.to_owned()),
-            ]
-        );
-    }
-
-    #[test]
-    fn head_without_prefix_is_ignored() {
-        let event = state_event(&[&["HEAD", "main"]]);
-
-        let (refs, head) = parse_state(&event);
-
-        assert!(refs.is_empty());
-        assert!(head.is_none());
-    }
-
-    #[test]
-    fn ignores_non_state_tags() {
-        let event = state_event(&[&["d", "my-repo"], &["name", "ignored"]]);
-
-        let (refs, head) = parse_state(&event);
-
-        assert!(refs.is_empty());
-        assert!(head.is_none());
-    }
-
-    #[test]
-    fn build_state_round_trips_through_parse() {
-        let refs = [
-            ("refs/heads/main".to_owned(), COMMIT_A.to_owned()),
-            ("refs/heads/dev".to_owned(), COMMIT_B.to_owned()),
-            ("refs/tags/v1.0".to_owned(), COMMIT_A.to_owned()),
-        ];
-
-        let event = build_state("my-repo", &refs, Some("main"))
-            .finalize(&keys())
-            .expect("signed event");
-
-        assert_eq!(event.kind, Kind::RepoState);
-        assert_eq!(event.tags.identifier().as_deref(), Some("my-repo"));
-
-        let (parsed_refs, head) = parse_state(&event);
-        assert_eq!(parsed_refs, refs);
-        assert_eq!(head.as_deref(), Some("main"));
-    }
-
-    #[test]
-    fn build_state_omits_head_when_detached() {
-        let refs = [("refs/heads/main".to_owned(), COMMIT_A.to_owned())];
-
-        let event = build_state("my-repo", &refs, None)
-            .finalize(&keys())
-            .expect("signed event");
-
-        let (parsed_refs, head) = parse_state(&event);
-        assert_eq!(parsed_refs, refs);
-        assert!(head.is_none());
-    }
-}

crates/signed_core/src/status.rs

@@ -1,6 +1,5 @@
 use nostr::prelude::*;
 
-/// Status of a root patch, pull request or issue (kinds `1630..=1633`).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum RepoStatus {
     Open,
@@ -28,42 +27,29 @@ impl RepoStatus {
             Self::Draft => Kind::GitStatusDraft,
         }
     }
-}
 
-/// Check whether an event references the given root event via an `e` or `E`
-/// tag. NIP-10 / NIP-34 use the lowercase `e` tag; NIP-22 comments (kind
-/// `1111`) use the uppercase `E` tag for the root of the thread.
-pub fn references_root(event: &Event, root: &EventId) -> bool {
-    let root = root.to_hex();
-    event
-        .tags
-        .iter()
-        .any(|tag| matches!(tag.kind(), "e" | "E") && tag.content() == Some(root.as_str()))
-}
-
-/// Resolve the status of a root event per NIP-34:
-/// the most recent status event from the root author or a maintainer wins.
-/// Defaults to [`RepoStatus::Open`].
-pub fn resolve_status<'a, I>(
-    status_events: I,
-    root_author: &PublicKey,
-    maintainers: &[PublicKey],
-) -> RepoStatus
-where
-    I: IntoIterator<Item = &'a Event>,
-{
-    status_events
-        .into_iter()
-        .filter(|e| RepoStatus::from_kind(e.kind).is_some())
-        .filter(|e| &e.pubkey == root_author || maintainers.contains(&e.pubkey))
-        .max_by_key(|e| e.created_at)
-        .and_then(|e| RepoStatus::from_kind(e.kind))
-        .unwrap_or(RepoStatus::Open)
+    pub fn resolve<'a, I>(
+        status_events: I,
+        root_author: &PublicKey,
+        maintainers: &[PublicKey],
+    ) -> Self
+    where
+        I: IntoIterator<Item = &'a Event>,
+    {
+        status_events
+            .into_iter()
+            .filter(|e| RepoStatus::from_kind(e.kind).is_some())
+            .filter(|e| &e.pubkey == root_author || maintainers.contains(&e.pubkey))
+            .max_by_key(|e| e.created_at)
+            .and_then(|e| RepoStatus::from_kind(e.kind))
+            .unwrap_or(RepoStatus::Open)
+    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::GitEvent;
 
     const ROOT_ID_HEX: &str = "1111111111111111111111111111111111111111111111111111111111111111";
     const OTHER_ID_HEX: &str = "2222222222222222222222222222222222222222222222222222222222222222";
@@ -76,7 +62,6 @@ mod tests {
         EventId::from_hex(ROOT_ID_HEX).expect("valid event id")
     }
 
-    /// Build a signed status event with a controlled `created_at`.
     fn status_event(author: &Keys, kind: Kind, root: EventId, created_at: u64) -> Event {
         EventBuilder::new(kind, "")
             .tags([Tag::event(root)])
@@ -95,58 +80,8 @@ mod tests {
             ))
             .expect("signed event");
 
-        assert!(references_root(&event, &root));
-        assert!(!references_root(
-            &event,
-            &EventId::from_hex(OTHER_ID_HEX).expect("valid id")
-        ));
-    }
-
-    #[test]
-    fn references_root_matches_uppercase_e_tag() {
-        let root = root_event_id();
-        let event = EventBuilder::new(Kind::Comment, "")
-            .tags([Tag::parse(["E", ROOT_ID_HEX]).expect("valid E tag")])
-            .finalize(&keys_from_hex(
-                "0000000000000000000000000000000000000000000000000000000000000001",
-            ))
-            .expect("signed event");
-
-        assert!(references_root(&event, &root));
-        assert!(!references_root(
-            &event,
-            &EventId::from_hex(OTHER_ID_HEX).expect("valid id")
-        ));
-    }
-
-    #[test]
-    fn references_root_false_without_e_tags() {
-        let event = EventBuilder::new(Kind::GitStatusOpen, "")
-            .finalize(&keys_from_hex(
-                "0000000000000000000000000000000000000000000000000000000000000001",
-            ))
-            .expect("signed event");
-
-        assert!(!references_root(&event, &root_event_id()));
-    }
-
-    #[test]
-    fn defaults_to_open_without_status_events() {
-        let owner =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000001");
-        let maintainer =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000002");
-
-        let statuses: Vec<Event> = Vec::new();
-
-        assert_eq!(
-            resolve_status(
-                statuses.iter(),
-                &owner.public_key(),
-                &[maintainer.public_key()]
-            ),
-            RepoStatus::Open
-        );
+        assert!(event.references_root(&root));
+        assert!(!event.references_root(&EventId::from_hex(OTHER_ID_HEX).expect("valid id")));
     }
 
     #[test]
@@ -163,7 +98,7 @@ mod tests {
         ];
 
         assert_eq!(
-            resolve_status(
+            RepoStatus::resolve(
                 statuses.iter(),
                 &owner.public_key(),
                 &[maintainer.public_key()]
@@ -188,7 +123,7 @@ mod tests {
         ];
 
         assert_eq!(
-            resolve_status(
+            RepoStatus::resolve(
                 statuses.iter(),
                 &owner.public_key(),
                 &[maintainer.public_key()]
@@ -196,18 +131,4 @@ mod tests {
             RepoStatus::Draft
         );
     }
-
-    #[test]
-    fn ignores_non_status_kinds() {
-        let owner =
-            keys_from_hex("0000000000000000000000000000000000000000000000000000000000000001");
-        let root = root_event_id();
-
-        let statuses = [status_event(&owner, Kind::GitIssue, root, 100)];
-
-        assert_eq!(
-            resolve_status(statuses.iter(), &owner.public_key(), &[]),
-            RepoStatus::Open
-        );
-    }
 }

crates/signed_core/src/upstream.rs

@@ -0,0 +1,33 @@
+use nostr::prelude::*;
+
+use crate::RepoAddr;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Upstream {
+    pub raw: String,
+    pub addr: Option<RepoAddr>,
+}
+
+impl Upstream {
+    /// Parses a raw `u` tag value, extracting the coordinate when present.
+    pub(crate) fn parse(raw: &str) -> Self {
+        let coordinate = raw.split('|').next().unwrap_or(raw);
+        let addr = coordinate
+            .parse::<Coordinate>()
+            .ok()
+            .filter(|coordinate| coordinate.kind == Kind::GitRepoAnnouncement)
+            .map(RepoAddr::from);
+        Self {
+            raw: raw.to_owned(),
+            addr,
+        }
+    }
+
+    /// Shows the coordinate when parsed, otherwise the raw value.
+    pub fn display(&self) -> String {
+        match &self.addr {
+            Some(addr) => addr.to_string(),
+            None => self.raw.clone(),
+        }
+    }
+}

crates/signed_git/Cargo.toml

@@ -8,8 +8,15 @@ publish.workspace = true
 signed_core = { path = "../signed_core" }
 
 nostr.workspace = true
-gix = { workspace = true, features = ["revision", "blob-diff"] }
+serde.workspace = true
+serde_json.workspace = true
+log.workspace = true
 anyhow.workspace = true
+gix = { workspace = true, features = ["revision", "blob-diff"] }
+gix-worktree = "0.57"
+gix-worktree-state = "0.35"
+diffy = "0.5"
+ignore = "0.4"
 
 [dev-dependencies]
 tempfile = "3"

crates/signed_git/src/cache.rs

@@ -0,0 +1,114 @@
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, PoisonError};
+
+use anyhow::Result;
+use signed_core::{Announcement, RepoAddr};
+
+use crate::repo::Repo;
+
+#[derive(Debug, Clone)]
+pub struct GitCache {
+    root: PathBuf,
+    clone_locks: Arc<Mutex<HashMap<PathBuf, Arc<Mutex<()>>>>>,
+}
+
+impl GitCache {
+    /// Creates a cache rooted at `root`.
+    pub fn new(root: PathBuf) -> Self {
+        Self {
+            root,
+            clone_locks: Arc::default(),
+        }
+    }
+
+    /// Returns the cache root directory.
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    /// Returns the cache path for a repository address.
+    pub fn repo_path(&self, addr: &RepoAddr) -> PathBuf {
+        self.root
+            .join(addr.public_key().to_hex())
+            .join(Self::sanitize_path_component(addr.identifier()))
+    }
+
+    /// Opens the cached repository, or `None` when it is not cloned yet.
+    pub fn open(&self, addr: &RepoAddr) -> Result<Option<Repo>> {
+        let path = self.repo_path(addr);
+        match gix::open(&path) {
+            Ok(repo) => Ok(Some(Repo::new(repo))),
+            Err(e) if e.is_not_found() => Ok(None),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    /// Returns the clone lock for `path`, creating it on first use.
+    fn clone_lock(&self, path: &Path) -> Arc<Mutex<()>> {
+        let mut locks = self
+            .clone_locks
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner);
+        Arc::clone(locks.entry(path.to_path_buf()).or_default())
+    }
+
+    /// Returns the cached repository, cloning from one of `clone_urls` on first use.
+    pub fn ensure_clone<U: AsRef<str>>(&self, addr: &RepoAddr, clone_urls: &[U]) -> Result<Repo> {
+        let path = self.repo_path(addr);
+
+        // Lock the clone lock for this path to prevent concurrent clones.
+        let clone_lock = self.clone_lock(&path);
+        let _clone_guard = clone_lock.lock().unwrap_or_else(PoisonError::into_inner);
+
+        // Refreshes the cached repository if it is already cloned, or clones it from one of `clone_urls` otherwise.
+        if let Ok(Some(repo)) = self.open(addr) {
+            if let Err(error) = repo.fetch() {
+                log::warn!("failed to refresh the cached repository: {error:#}");
+            }
+            return Ok(repo);
+        }
+
+        // Create the parent directory if it does not exist.
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent)?;
+        }
+
+        // Remove the cached clone if it exists but is unusable.
+        if path.exists() {
+            log::warn!("removing unusable cached clone at {}", path.display());
+            std::fs::remove_dir_all(&path)?;
+        }
+
+        Repo::clone(clone_urls, &path)
+    }
+
+    /// Maps untrusted relay content onto a safe single path component.
+    pub fn sanitize_path_component(id: &str) -> String {
+        let sanitized: String = id
+            .chars()
+            .map(|c| {
+                if c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.') {
+                    c
+                } else {
+                    '_'
+                }
+            })
+            .collect();
+
+        if sanitized == "." || sanitized == ".." {
+            return "_".to_owned();
+        }
+
+        sanitized
+    }
+
+    /// Returns the `owner/identifier` namespace used for fork checkouts.
+    pub fn fork_namespace(announcement: &Announcement) -> String {
+        format!(
+            "{}/{}",
+            announcement.owner.to_hex(),
+            Self::sanitize_path_component(&announcement.id)
+        )
+    }
+}

crates/signed_git/src/diff.rs

@@ -0,0 +1,237 @@
+use gix::diff::blob::unified_diff::{ConsumeHunk, DiffLineKind as GixLineKind, HunkHeader};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DiffLineKind {
+    Context,
+    Addition,
+    Deletion,
+}
+
+#[derive(Debug, Clone)]
+pub struct DiffLine {
+    pub kind: DiffLineKind,
+    pub old: Option<u32>,
+    pub new: Option<u32>,
+    pub text: String,
+}
+
+impl DiffLine {
+    /// Creates a diff line with its kind, optional line numbers, and text.
+    pub fn new(kind: DiffLineKind, old: Option<u32>, new: Option<u32>, text: String) -> Self {
+        Self {
+            kind,
+            old,
+            new,
+            text,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct DiffHunk {
+    pub old_start: u32,
+    pub old_lines: u32,
+    pub new_start: u32,
+    pub new_lines: u32,
+    pub lines: Vec<DiffLine>,
+}
+
+impl DiffHunk {
+    /// Creates a hunk spanning the given old and new ranges.
+    pub fn new(
+        old_start: u32,
+        old_lines: u32,
+        new_start: u32,
+        new_lines: u32,
+        lines: Vec<DiffLine>,
+    ) -> Self {
+        Self {
+            old_start,
+            old_lines,
+            new_start,
+            new_lines,
+            lines,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DiffStatus {
+    Added,
+    Modified,
+    Deleted,
+    Renamed,
+    Copied,
+}
+
+#[derive(Debug, Clone)]
+pub struct FileDiff {
+    pub path: String,
+    pub old_path: Option<String>,
+    pub status: DiffStatus,
+    pub insertions: usize,
+    pub deletions: usize,
+    pub binary: bool,
+    pub hunks: Vec<DiffHunk>,
+}
+
+impl FileDiff {
+    /// Creates a file diff; `old_path` is the rename or copy source and `binary` files have no hunks.
+    pub fn new(
+        path: String,
+        old_path: Option<String>,
+        status: DiffStatus,
+        insertions: usize,
+        deletions: usize,
+        binary: bool,
+        hunks: Vec<DiffHunk>,
+    ) -> Self {
+        Self {
+            path,
+            old_path,
+            status,
+            insertions,
+            deletions,
+            binary,
+            hunks,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct CommitDiff {
+    pub files: Vec<FileDiff>,
+}
+
+impl CommitDiff {
+    /// Creates a commit diff from its files.
+    pub fn new(files: Vec<FileDiff>) -> Self {
+        Self { files }
+    }
+}
+
+pub(crate) struct HunkBuilder {
+    old_start: u32,
+    old_lines: u32,
+    new_start: u32,
+    new_lines: u32,
+    old: u32,
+    new: u32,
+    lines: Vec<DiffLine>,
+    insertions: usize,
+    deletions: usize,
+}
+
+impl HunkBuilder {
+    /// Starts a hunk spanning the given old and new ranges.
+    pub(crate) fn new(old_start: u32, old_lines: u32, new_start: u32, new_lines: u32) -> Self {
+        Self {
+            old_start,
+            old_lines,
+            new_start,
+            new_lines,
+            old: old_start,
+            new: new_start,
+            lines: Vec::new(),
+            insertions: 0,
+            deletions: 0,
+        }
+    }
+
+    /// Appends a line, numbering it and counting insertions and deletions.
+    pub(crate) fn push(&mut self, kind: DiffLineKind, text: impl Into<String>) {
+        let (old_no, new_no) = match kind {
+            DiffLineKind::Context => {
+                let numbers = (Some(self.old), Some(self.new));
+                self.old += 1;
+                self.new += 1;
+                numbers
+            }
+            DiffLineKind::Addition => {
+                self.insertions += 1;
+                let number = Some(self.new);
+                self.new += 1;
+                (None, number)
+            }
+            DiffLineKind::Deletion => {
+                self.deletions += 1;
+                let number = Some(self.old);
+                self.old += 1;
+                (number, None)
+            }
+        };
+
+        self.lines
+            .push(DiffLine::new(kind, old_no, new_no, text.into()));
+    }
+
+    /// Finishes the hunk and returns it with its insertion and deletion counts.
+    pub(crate) fn finish(self) -> (DiffHunk, usize, usize) {
+        let hunk = DiffHunk::new(
+            self.old_start,
+            self.old_lines,
+            self.new_start,
+            self.new_lines,
+            self.lines,
+        );
+        (hunk, self.insertions, self.deletions)
+    }
+}
+
+pub(crate) struct HunkCollector<'a> {
+    hunks: &'a mut Vec<DiffHunk>,
+    insertions: &'a mut usize,
+    deletions: &'a mut usize,
+}
+
+impl<'a> HunkCollector<'a> {
+    /// Collects hunks into `hunks` while counting `insertions` and `deletions`.
+    pub(crate) fn new(
+        hunks: &'a mut Vec<DiffHunk>,
+        insertions: &'a mut usize,
+        deletions: &'a mut usize,
+    ) -> Self {
+        Self {
+            hunks,
+            insertions,
+            deletions,
+        }
+    }
+}
+
+impl ConsumeHunk for HunkCollector<'_> {
+    type Out = ();
+
+    /// Consumes one hunk, tracking line numbers and insertion/deletion counts.
+    fn consume_hunk(
+        &mut self,
+        header: HunkHeader,
+        lines: &[(GixLineKind, &[u8])],
+    ) -> std::io::Result<()> {
+        let mut builder = HunkBuilder::new(
+            header.before_hunk_start,
+            header.before_hunk_len,
+            header.after_hunk_start,
+            header.after_hunk_len,
+        );
+
+        for (kind, content) in lines {
+            let kind = match kind {
+                GixLineKind::Context => DiffLineKind::Context,
+                GixLineKind::Remove => DiffLineKind::Deletion,
+                GixLineKind::Add => DiffLineKind::Addition,
+            };
+            builder.push(kind, String::from_utf8_lossy(content).into_owned());
+        }
+
+        let (hunk, insertions, deletions) = builder.finish();
+        *self.insertions += insertions;
+        *self.deletions += deletions;
+        self.hunks.push(hunk);
+
+        Ok(())
+    }
+
+    /// Marks the end of the unified diff stream.
+    fn finish(self) {}
+}

crates/signed_git/src/history.rs

@@ -0,0 +1,77 @@
+pub const MAX_LISTED_COMMITS: usize = 20_000;
+
+pub struct CommitList {
+    pub total: usize,
+    pub commits: Vec<FileCommit>,
+}
+
+impl CommitList {
+    /// Creates a list holding `total` commits of which `commits` are materialized.
+    pub fn new(total: usize, commits: Vec<FileCommit>) -> Self {
+        Self { total, commits }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct FileCommit {
+    pub id: String,
+    pub summary: String,
+    pub description: Option<String>,
+    pub author: String,
+    pub time: i64,
+}
+
+impl FileCommit {
+    /// Creates a commit entry from its id, message parts, author, and timestamp.
+    pub fn new(
+        id: String,
+        summary: String,
+        description: Option<String>,
+        author: String,
+        time: i64,
+    ) -> Self {
+        Self {
+            id,
+            summary,
+            description,
+            author,
+            time,
+        }
+    }
+
+    /// Converts a gix commit including its message body.
+    pub(crate) fn from_commit(commit: &gix::Commit<'_>) -> anyhow::Result<Self> {
+        Self::from_commit_with_description(commit, true)
+    }
+
+    /// Converts a gix commit, skipping the message body since lists never show it.
+    pub(crate) fn from_commit_summary(commit: &gix::Commit<'_>) -> anyhow::Result<Self> {
+        Self::from_commit_with_description(commit, false)
+    }
+
+    /// Converts a gix commit, optionally skipping the message body.
+    fn from_commit_with_description(
+        commit: &gix::Commit<'_>,
+        include_description: bool,
+    ) -> anyhow::Result<Self> {
+        use crate::GixResultExt as _;
+
+        let author = commit.author().into_anyhow()?;
+        let message = commit.message().into_anyhow()?;
+
+        Ok(FileCommit::new(
+            commit.id().shorten_or_id().to_string(),
+            String::from_utf8_lossy(message.title).trim().to_string(),
+            if include_description {
+                message
+                    .body
+                    .map(|body| String::from_utf8_lossy(body).trim().to_string())
+                    .filter(|body| !body.is_empty())
+            } else {
+                None
+            },
+            String::from_utf8_lossy(author.name).trim().to_string(),
+            author.time().into_anyhow()?.seconds,
+        ))
+    }
+}

crates/signed_git/src/nip34.rs

@@ -0,0 +1,63 @@
+use nostr::prelude::*;
+
+#[derive(serde::Deserialize)]
+pub(crate) struct Nip34Json {
+    pub(crate) identifier: Option<String>,
+    pub(crate) owner: Option<String>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Nip34Kind {
+    Initialized,
+    Cloned,
+    ToolingOnly,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct GraspSignals {
+    pub nip34_json: bool,
+    pub nip34_excluded: bool,
+    pub nostr_repo_config: bool,
+    pub nostr_remote: bool,
+    pub grasp_remote: bool,
+    pub nip34_grasp_remote: bool,
+    pub nip34_state_refs: bool,
+    pub nostr_cache: bool,
+    pub nostr_aux_config: bool,
+    pub maintainers_yaml: bool,
+}
+
+impl GraspSignals {
+    /// Returns whether any Nostr tooling marker was found.
+    pub fn any(&self) -> bool {
+        *self != Self::default()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Nip34Binding {
+    pub kind: Nip34Kind,
+    pub signals: GraspSignals,
+    pub owner: Option<PublicKey>,
+    pub identifier: Option<String>,
+    pub grasp_urls: Vec<String>,
+}
+
+impl Nip34Binding {
+    /// Creates a binding from its kind, detected signals, and recovered coordinates.
+    pub fn new(
+        kind: Nip34Kind,
+        signals: GraspSignals,
+        owner: Option<PublicKey>,
+        identifier: Option<String>,
+        grasp_urls: Vec<String>,
+    ) -> Self {
+        Self {
+            kind,
+            signals,
+            owner,
+            identifier,
+            grasp_urls,
+        }
+    }
+}

crates/signed_git/src/patch.rs

@@ -0,0 +1,238 @@
+use anyhow::Result;
+use diffy::patch_set::{FileOperation, FilePatch, ParseOptions, PatchSet};
+use diffy::{Hunk, Line};
+
+use crate::diff::{CommitDiff, DiffHunk, DiffLineKind, DiffStatus, FileDiff, HunkBuilder};
+use crate::history::FileCommit;
+
+pub struct PatchParser;
+
+impl PatchParser {
+    /// Splits an mbox series into the raw text of each message.
+    pub fn split_patch_series(patch: &str) -> Vec<&str> {
+        Self::envelopes(patch)
+            .into_iter()
+            .map(|message| message.text)
+            .collect()
+    }
+
+    /// Parses a git diff into file diffs, returning an empty diff without one.
+    pub fn patch_diffs(patch: &str) -> Result<CommitDiff> {
+        if !patch.lines().any(|line| line.starts_with("diff --git ")) {
+            return Ok(CommitDiff::new(Vec::new()));
+        }
+
+        let mut files = Vec::new();
+
+        for file in PatchSet::parse(patch, ParseOptions::gitdiff()) {
+            files.push(Self::file_diff(file?));
+        }
+
+        Ok(CommitDiff::new(files))
+    }
+
+    /// Lists the commits represented by the mbox messages that carry an id.
+    pub fn patch_commits(patch: &str) -> Vec<FileCommit> {
+        Self::envelopes(patch)
+            .into_iter()
+            .filter(|message| !message.id.is_empty())
+            .map(|message| {
+                FileCommit::new(
+                    message.id.to_string(),
+                    message
+                        .header("Subject")
+                        .map(Self::strip_patch_prefix)
+                        .unwrap_or_default(),
+                    None,
+                    message
+                        .header("From")
+                        .map(Self::name_from_address)
+                        .unwrap_or_default(),
+                    message
+                        .header("Date")
+                        .and_then(|value| gix::date::parse(value.trim(), None).ok())
+                        .map(|time| time.seconds)
+                        .unwrap_or(0),
+                )
+            })
+            .collect()
+    }
+
+    /// Splits `patch` on `From <40-hex> <date>` envelopes, falling back to one message.
+    fn envelopes(patch: &str) -> Vec<Envelope<'_>> {
+        let mut messages: Vec<Envelope<'_>> = Vec::new();
+        let mut current: Option<(usize, &str, Vec<&str>)> = None;
+        let mut headers_closed = false;
+
+        let mut offset = 0usize;
+        for line in patch.lines() {
+            let line_start = offset;
+            offset += line.len() + 1;
+
+            let is_envelope = line
+                .strip_prefix("From ")
+                .and_then(|rest| rest.split_whitespace().next())
+                .is_some_and(|id| id.len() == 40);
+
+            if is_envelope {
+                if let Some((start, id, headers)) = current.take() {
+                    messages.push(Envelope::new(&patch[start..], id, headers));
+                }
+
+                let id = line
+                    .strip_prefix("From ")
+                    .and_then(|rest| rest.split_whitespace().next())
+                    .unwrap_or("");
+
+                current = Some((line_start, id, Vec::new()));
+                headers_closed = false;
+                continue;
+            }
+
+            if let Some((_, _, headers)) = &mut current {
+                if headers_closed {
+                    continue;
+                }
+                if line.is_empty() {
+                    headers_closed = true;
+                } else {
+                    headers.push(line);
+                }
+            }
+        }
+
+        if let Some((start, id, headers)) = current.take() {
+            messages.push(Envelope::new(&patch[start..], id, headers));
+        }
+
+        if messages.is_empty() {
+            messages.push(Envelope::new(patch, "", Vec::new()));
+        }
+
+        messages
+    }
+
+    /// Extracts the display name from a `From` header value.
+    fn name_from_address(from: &str) -> String {
+        match from.trim().find('<') {
+            Some(ix) => from[..ix].trim().to_string(),
+            None => from.trim().to_string(),
+        }
+    }
+
+    /// Strips mailing list prefixes like `[PATCH]` or `[RFC PATCH 1/2]`.
+    fn strip_patch_prefix(subject: &str) -> String {
+        let trimmed = subject.trim();
+        let Some(rest) = trimmed.strip_prefix('[') else {
+            return trimmed.to_string();
+        };
+        let Some(end) = rest.find(']') else {
+            return trimmed.to_string();
+        };
+        if rest[..end].to_ascii_lowercase().contains("patch") {
+            rest[end + 1..].trim().to_string()
+        } else {
+            trimmed.to_string()
+        }
+    }
+
+    /// Converts one parsed file patch, keeping rename and copy paths unstripped.
+    fn file_diff(file: FilePatch<'_, str>) -> FileDiff {
+        let stripped;
+        let operation = match file.operation() {
+            operation @ (FileOperation::Rename { .. } | FileOperation::Copy { .. }) => operation,
+            operation => {
+                stripped = operation.strip_prefix(1);
+                &stripped
+            }
+        };
+
+        let (path, old_path, status) = match operation {
+            FileOperation::Create(path) => (path.as_ref(), None, DiffStatus::Added),
+            FileOperation::Delete(path) => (path.as_ref(), None, DiffStatus::Deleted),
+            FileOperation::Modify { modified, .. } => {
+                (modified.as_ref(), None, DiffStatus::Modified)
+            }
+            FileOperation::Rename { from, to } => {
+                (to.as_ref(), Some(from.as_ref()), DiffStatus::Renamed)
+            }
+            FileOperation::Copy { from, to } => {
+                (to.as_ref(), Some(from.as_ref()), DiffStatus::Copied)
+            }
+        };
+
+        let mut insertions = 0usize;
+        let mut deletions = 0usize;
+        let mut hunks = Vec::new();
+
+        let patch = file.patch();
+
+        if let Some(text) = patch.as_text() {
+            for hunk in text.hunks() {
+                let (hunk, hunk_insertions, hunk_deletions) = Self::hunk_diff(hunk);
+                insertions += hunk_insertions;
+                deletions += hunk_deletions;
+                hunks.push(hunk);
+            }
+        }
+
+        FileDiff::new(
+            path.to_owned(),
+            old_path.map(str::to_owned),
+            status,
+            insertions,
+            deletions,
+            patch.is_binary(),
+            hunks,
+        )
+    }
+
+    /// Converts a diffy hunk into a `DiffHunk` with its insertion and deletion counts.
+    fn hunk_diff(hunk: &Hunk<'_, str>) -> (DiffHunk, usize, usize) {
+        let old_range = hunk.old_range();
+        let new_range = hunk.new_range();
+
+        let mut builder = HunkBuilder::new(
+            old_range.start() as u32,
+            old_range.len() as u32,
+            new_range.start() as u32,
+            new_range.len() as u32,
+        );
+
+        for line in hunk.lines() {
+            let (kind, text) = match line {
+                Line::Context(text) => (DiffLineKind::Context, *text),
+                Line::Delete(text) => (DiffLineKind::Deletion, *text),
+                Line::Insert(text) => (DiffLineKind::Addition, *text),
+            };
+
+            let text = text.strip_suffix('\n').unwrap_or(text);
+            let text = text.strip_suffix('\r').unwrap_or(text);
+            builder.push(kind, text.to_owned());
+        }
+
+        builder.finish()
+    }
+}
+
+struct Envelope<'a> {
+    text: &'a str,
+    id: &'a str,
+    headers: Vec<&'a str>,
+}
+
+impl<'a> Envelope<'a> {
+    /// Creates an envelope from its text, commit id, and header lines.
+    fn new(text: &'a str, id: &'a str, headers: Vec<&'a str>) -> Self {
+        Self { text, id, headers }
+    }
+
+    /// Returns the first header line matching `name: `.
+    fn header(&self, name: &str) -> Option<&str> {
+        let prefix = format!("{name}: ");
+        self.headers
+            .iter()
+            .find(|line| line.starts_with(&prefix))
+            .map(|line| &line[prefix.len()..])
+    }
+}

crates/signed_git/src/scan.rs

@@ -0,0 +1,82 @@
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+
+use ignore::WalkBuilder;
+
+use crate::nip34::Nip34Binding;
+use crate::repo::Repo;
+
+const SCAN_MAX_DEPTH: usize = 12;
+
+#[derive(Debug, Clone)]
+pub struct LocalRepo {
+    pub path: PathBuf,
+    pub nip34: Option<Nip34Binding>,
+}
+
+impl LocalRepo {
+    /// Creates a local repository entry from its path and optional NIP-34 binding.
+    pub fn new(path: PathBuf, nip34: Option<Nip34Binding>) -> Self {
+        Self { path, nip34 }
+    }
+}
+
+/// Finds git repositories under `root` up to `SCAN_MAX_DEPTH` deep, without descending into them.
+pub fn find_git_repos(root: &Path) -> Vec<LocalRepo> {
+    let Ok(root) = root.canonicalize() else {
+        return Vec::new();
+    };
+
+    let found = Arc::new(Mutex::new(Vec::<PathBuf>::new()));
+
+    let walker = WalkBuilder::new(&root)
+        .max_depth(Some(SCAN_MAX_DEPTH))
+        .require_git(false)
+        .filter_entry({
+            let found = found.clone();
+            move |entry| {
+                let Some(kind) = entry.file_type() else {
+                    return true;
+                };
+                if !kind.is_dir() {
+                    return true;
+                }
+
+                let dir = entry.path();
+                let Ok(repo) = gix::discover(dir) else {
+                    return true;
+                };
+
+                let Some(workdir) = repo.workdir() else {
+                    return false;
+                };
+
+                if workdir != dir {
+                    return true;
+                }
+
+                match found.lock() {
+                    Ok(mut repos) => repos.push(dir.to_path_buf()),
+                    Err(poisoned) => poisoned.into_inner().push(dir.to_path_buf()),
+                }
+                false
+            }
+        })
+        .build();
+
+    for _ in walker {}
+
+    let mut repos = match found.lock() {
+        Ok(mut repos) => std::mem::take(&mut *repos),
+        Err(poisoned) => std::mem::take(&mut *poisoned.into_inner()),
+    };
+    repos.sort();
+
+    repos
+        .into_iter()
+        .map(|path| {
+            let nip34 = Repo::open(&path).ok().and_then(|repo| repo.nip34_binding());
+            LocalRepo::new(path, nip34)
+        })
+        .collect()
+}

crates/signed_git/src/sync.rs

@@ -0,0 +1,38 @@
+use std::collections::BTreeMap;
+
+/// How a single branch compares between local and Nostr.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RefSync {
+    InSync,
+    LocalAhead { ahead: usize },
+    RemoteAhead { behind: usize },
+    Diverged { ahead: usize, behind: usize },
+    LocalOnly,
+    RemoteOnly,
+}
+
+/// Branch comparison between a local repository and its Nostr state.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RepoSyncStatus {
+    /// Branch short name and its classification.
+    pub refs: Vec<(String, RefSync)>,
+    pub ahead_total: usize,
+    pub behind_total: usize,
+}
+
+impl RepoSyncStatus {
+    /// True when every branch matches the Nostr state.
+    pub fn in_sync(&self) -> bool {
+        self.refs.iter().all(|(_, sync)| *sync == RefSync::InSync)
+    }
+
+    /// Maps branch short name to lowercase commit oid.
+    pub(crate) fn branches(refs: &[(String, String)]) -> BTreeMap<&str, String> {
+        refs.iter()
+            .filter_map(|(name, commit)| {
+                name.strip_prefix("refs/heads/")
+                    .map(|branch| (branch, commit.to_ascii_lowercase()))
+            })
+            .collect()
+    }
+}

crates/signed_git/src/tests.rs

@@ -0,0 +1,849 @@
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use nostr::prelude::Keys;
+use signed_core::RepoAddr;
+
+use super::*;
+
+#[test]
+fn blocks_parent_components() {
+    assert_eq!(GitCache::sanitize_path_component(".."), "_");
+    assert_eq!(GitCache::sanitize_path_component("."), "_");
+    assert_eq!(GitCache::sanitize_path_component("../.."), ".._..");
+    assert_eq!(GitCache::sanitize_path_component("a/../b"), "a_.._b");
+}
+
+#[test]
+fn concurrent_ensure_clone_succeeds_for_every_caller() {
+    let server = tempfile::tempdir().expect("tempdir");
+    let server_repo = bare_server(server.path(), "npub1test", "repo");
+
+    let (work_dir, work_repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&work_repo, "initial");
+    let work_dir = work_dir.path();
+
+    let base_url = format!("file://{}", server.path().display());
+    Repo::open(work_dir)
+        .expect("open")
+        .push_all(&base_url, "npub1test", "repo")
+        .expect("push");
+
+    let cache_dir = tempfile::tempdir().expect("tempdir");
+    let cache = GitCache::new(cache_dir.path().to_path_buf());
+    let addr = RepoAddr::new(Keys::generate().public_key(), "repo");
+    let clone_url = format!("file://{}", server_repo.display());
+
+    std::thread::scope(|scope| {
+        for _ in 0..4 {
+            scope.spawn(|| {
+                cache
+                    .ensure_clone(&addr, &[&clone_url])
+                    .expect("ensure_clone");
+            });
+        }
+    });
+
+    assert!(cache.open(&addr).expect("open").is_some());
+}
+
+#[test]
+fn ensure_clone_recovers_from_a_leftover_directory() {
+    let server = tempfile::tempdir().expect("tempdir");
+    let server_repo = bare_server(server.path(), "npub1test", "repo");
+
+    let (work_dir, work_repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&work_repo, "initial");
+    let work_dir = work_dir.path();
+
+    let base_url = format!("file://{}", server.path().display());
+    Repo::open(work_dir)
+        .expect("open")
+        .push_all(&base_url, "npub1test", "repo")
+        .expect("push");
+
+    let cache_dir = tempfile::tempdir().expect("tempdir");
+    let cache = GitCache::new(cache_dir.path().to_path_buf());
+    let addr = RepoAddr::new(Keys::generate().public_key(), "repo");
+    let clone_url = format!("file://{}", server_repo.display());
+
+    // Simulate the remains of an interrupted clone.
+    let leftover = cache.repo_path(&addr);
+    std::fs::create_dir_all(&leftover).expect("mkdir");
+
+    cache
+        .ensure_clone(&addr, &[&clone_url])
+        .expect("ensure_clone");
+
+    assert!(cache.open(&addr).expect("open").is_some());
+}
+
+#[test]
+fn root_commit_reports_the_first_ancestor() {
+    let (dir, repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&repo, "initial");
+
+    let dir = dir.path();
+    let root = repo.root_commit().expect("root").expect("commit");
+    assert_eq!(root.len(), 40);
+
+    std::fs::write(dir.join("b.txt"), b"two").expect("write");
+    commit_all(&repo, "second");
+    assert_eq!(
+        repo.root_commit().expect("root").as_deref(),
+        Some(root.as_str())
+    );
+}
+
+#[test]
+fn push_all_mirrors_branches_and_tags() {
+    let server = tempfile::tempdir().unwrap();
+    let server_repo = bare_server(server.path(), "npub1test", "my-repo");
+
+    let (dir, repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&repo, "initial");
+    let dir = dir.path();
+
+    git_run(dir, &["checkout", "-b", "feature"]);
+    std::fs::write(dir.join("b.txt"), b"two").expect("write");
+    commit_all(&repo, "feature work");
+    git_run(dir, &["checkout", "-"]);
+    git_run(dir, &["tag", "v1.0"]);
+
+    let base_url = format!("file://{}", server.path().display());
+    Repo::open(dir)
+        .expect("open")
+        .push_all(&base_url, "npub1test", "my-repo")
+        .expect("push");
+
+    let refs = git_in(&server_repo, &["show-ref"]).expect("server refs");
+    assert!(refs.contains("refs/heads/main"));
+    assert!(refs.contains("refs/heads/feature"));
+    assert!(refs.contains("refs/tags/v1.0"));
+}
+
+#[test]
+fn ls_remote_lists_branches_and_tags_only() {
+    let server = tempfile::tempdir().unwrap();
+    let server_repo = bare_server(server.path(), "npub1test", "my-repo");
+
+    let (dir, repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&repo, "initial");
+    let dir = dir.path();
+
+    git_run(dir, &["branch", "feature"]);
+    git_run(dir, &["tag", "v1"]);
+    git_run(dir, &["tag", "-a", "v2", "-m", "annotated"]);
+
+    let base_url = format!("file://{}", server.path().display());
+    let local = Repo::open(dir).expect("open");
+    local
+        .push_all(&base_url, "npub1test", "my-repo")
+        .expect("push");
+
+    // Refs outside heads and tags, and the HEAD symref line, are not listed.
+    let main = git_in(dir, &["rev-parse", "refs/heads/main"]).expect("main oid");
+    git_run(&server_repo, &["update-ref", "refs/nostr/abc", &main]);
+
+    let remote = local
+        .ls_remote(&format!("file://{}", server_repo.display()))
+        .expect("ls-remote");
+    let names: Vec<String> = remote.iter().map(|(name, _)| name.clone()).collect();
+
+    assert_eq!(
+        names,
+        vec![
+            "refs/heads/feature".to_owned(),
+            "refs/heads/main".to_owned(),
+            "refs/tags/v1".to_owned(),
+            "refs/tags/v2".to_owned(),
+        ]
+    );
+    assert_eq!(
+        remote
+            .iter()
+            .find(|(name, _)| name == "refs/heads/main")
+            .map(|(_, oid)| oid.as_str()),
+        Some(main.as_str())
+    );
+    // The annotated tag lists the tag object, matching the local ref state,
+    // without a peeled `^{}` duplicate.
+    let v2 = git_in(dir, &["rev-parse", "refs/tags/v2"]).expect("v2 oid");
+    assert_eq!(
+        remote
+            .iter()
+            .find(|(name, _)| name == "refs/tags/v2")
+            .map(|(_, oid)| oid.as_str()),
+        Some(v2.as_str())
+    );
+}
+
+#[test]
+fn push_all_force_updates_diverged_remote_branches() {
+    let server = tempfile::tempdir().unwrap();
+    let server_repo = bare_server(server.path(), "npub1test", "my-repo");
+
+    let (dir, repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&repo, "initial");
+    std::fs::write(dir.path().join("b.txt"), b"two").expect("write");
+    commit_all(&repo, "second");
+    let dir = dir.path();
+
+    let base_url = format!("file://{}", server.path().display());
+    let local = Repo::open(dir).expect("open");
+    local
+        .push_all(&base_url, "npub1test", "my-repo")
+        .expect("initial push");
+
+    // Diverge local main from the pushed state.
+    git_run(dir, &["reset", "-q", "--hard", "HEAD~1"]);
+    std::fs::write(dir.join("c.txt"), b"three").expect("write");
+    commit_all(&repo, "diverged");
+
+    local
+        .push_all(&base_url, "npub1test", "my-repo")
+        .expect("force push");
+
+    assert_eq!(
+        git_in(dir, &["rev-parse", "refs/heads/main"]).expect("local main"),
+        git_in(&server_repo, &["rev-parse", "refs/heads/main"]).expect("server main")
+    );
+}
+
+#[test]
+fn push_refspecs_deletes_server_refs_missing_locally() {
+    let server = tempfile::tempdir().unwrap();
+    let server_repo = bare_server(server.path(), "npub1test", "my-repo");
+
+    let (dir, repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&repo, "initial");
+    let dir = dir.path();
+
+    git_run(dir, &["branch", "feature"]);
+    git_run(dir, &["tag", "v1"]);
+
+    let base_url = format!("file://{}", server.path().display());
+    let local = Repo::open(dir).expect("open");
+    local
+        .push_all(&base_url, "npub1test", "my-repo")
+        .expect("initial push");
+
+    git_run(dir, &["branch", "-D", "feature"]);
+    git_run(dir, &["tag", "-d", "v1"]);
+
+    local
+        .push_refspecs(
+            &base_url,
+            "npub1test",
+            "my-repo",
+            &[
+                "+refs/heads/*:refs/heads/*",
+                "+refs/tags/*:refs/tags/*",
+                ":refs/heads/feature",
+                ":refs/tags/v1",
+            ],
+        )
+        .expect("push with deletions");
+
+    let refs = git_in(&server_repo, &["show-ref"]).expect("server refs");
+    assert!(refs.contains("refs/heads/main"));
+    assert!(!refs.contains("refs/heads/feature"));
+    assert!(!refs.contains("refs/tags/v1"));
+}
+
+#[test]
+fn fetch_refs_brings_server_only_branches_into_local() {
+    let server = tempfile::tempdir().unwrap();
+    bare_server(server.path(), "npub1test", "my-repo");
+
+    let (dir, repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&repo, "initial");
+    let dir = dir.path();
+    git_run(dir, &["branch", "feature"]);
+
+    let base_url = format!("file://{}", server.path().display());
+    Repo::open(dir)
+        .expect("open")
+        .push_all(&base_url, "npub1test", "my-repo")
+        .expect("push");
+    let feature = git_in(dir, &["rev-parse", "refs/heads/feature"]).expect("feature oid");
+
+    // A repository that never had the branch fetches it by name.
+    let (other_dir, _other_repo) = fixture(&[("unrelated.txt", b"x")]);
+    let other = Repo::open(other_dir.path()).expect("open other");
+    let server_url = format!("file://{}/npub1test/my-repo.git", server.path().display());
+    other
+        .fetch_refs(&[&server_url], "+refs/heads/feature:refs/heads/feature")
+        .expect("fetch ref");
+
+    assert_eq!(
+        git_in(other_dir.path(), &["rev-parse", "refs/heads/feature"]).expect("fetched feature"),
+        feature
+    );
+}
+
+#[test]
+fn ref_state_matches_the_git_cli_ref_listing() {
+    let (dir, repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&repo, "initial");
+    let dir = dir.path();
+
+    git_run(dir, &["branch", "browse-group"]);
+    git_run(dir, &["checkout", "-q", "-b", "new-search"]);
+    std::fs::write(dir.join("b.txt"), b"two").expect("write");
+    commit_all(&repo, "search work");
+    git_run(dir, &["checkout", "-q", "-"]);
+    git_run(dir, &["tag", "v1"]);
+
+    let listing = |repo: &Repo| {
+        let mut refs = repo.ref_state().expect("ref state").refs;
+        refs.sort();
+        refs
+    };
+
+    // Loose refs.
+    let loose = listing(&Repo::open(dir).expect("open"));
+
+    // Packed refs.
+    git_run(dir, &["pack-refs", "--all"]);
+    let packed = listing(&Repo::open(dir).expect("open"));
+
+    let output = git_run(
+        dir,
+        &[
+            "for-each-ref",
+            "--format=%(refname) %(objectname)",
+            "refs/heads",
+            "refs/tags",
+        ],
+    );
+    let mut cli = String::from_utf8_lossy(&output.stdout)
+        .lines()
+        .map(|line| {
+            let (name, oid) = line.split_once(' ').expect("for-each-ref format");
+            (name.to_owned(), oid.to_owned())
+        })
+        .collect::<Vec<_>>();
+    cli.sort();
+
+    assert_eq!(loose, cli);
+    assert_eq!(packed, cli);
+    assert!(
+        loose
+            .iter()
+            .any(|(name, _)| name == "refs/heads/new-search")
+    );
+    assert!(
+        loose
+            .iter()
+            .any(|(name, _)| name == "refs/heads/browse-group")
+    );
+}
+
+#[test]
+fn repo_ref_state_lists_branches_tags_and_head() {
+    let (_dir, repo) = fixture(&[("a.txt", b"hello")]);
+    commit_all(&repo, "initial");
+    let workdir = repo.workdir().expect("workdir").to_path_buf();
+
+    let state = repo.ref_state().expect("refs");
+
+    let branch = repo.current_branch().expect("on a branch");
+    assert_eq!(state.head.as_deref(), Some(branch.as_str()));
+    assert_eq!(state.refs.len(), 1);
+    assert_eq!(state.refs[0].0, format!("refs/heads/{branch}"));
+    assert_eq!(state.refs[0].1.len(), 40);
+
+    git_run(&workdir, &["branch", "feature"]);
+    git_run(&workdir, &["tag", "v1.0"]);
+
+    let state = repo.ref_state().expect("refs");
+    let mut expected: Vec<String> = vec![
+        format!("refs/heads/{branch}"),
+        "refs/heads/feature".to_owned(),
+        "refs/tags/v1.0".to_owned(),
+    ];
+    expected.sort();
+    assert_eq!(
+        state
+            .refs
+            .iter()
+            .map(|(name, _)| name.clone())
+            .collect::<Vec<_>>(),
+        expected
+    );
+
+    git_run(&workdir, &["checkout", "--detach"]);
+    let state = repo.ref_state().expect("refs");
+    assert!(state.head.is_none());
+    assert_eq!(state.refs.len(), 3);
+}
+
+/// Creates a repository fixture with the given files.
+fn fixture(files: &[(&str, &[u8])]) -> (tempfile::TempDir, Repo) {
+    let dir = tempfile::tempdir().expect("tempdir");
+    gix::init(&dir).expect("init");
+
+    for (rel, bytes) in files {
+        let path = dir.path().join(rel);
+        std::fs::create_dir_all(path.parent().expect("parent")).expect("mkdir");
+        std::fs::write(&path, bytes).expect("write");
+    }
+
+    let repo = Repo::open(dir.path()).expect("open");
+    (dir, repo)
+}
+
+/// Stages and commits every change in the repository.
+fn commit_all(repo: &Repo, message: &str) {
+    git_run(repo.workdir().expect("workdir"), &["add", "-A"]);
+    git_run(repo.workdir().expect("workdir"), &["commit", "-m", message]);
+}
+
+#[test]
+fn merge_base_finds_the_fork_point_and_reports_unrelated_history() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let path = dir.path().join("repo");
+    let initial = Repo::init(&path, "My Repo", "desc").expect("init");
+    let repo = Repo::open(&path).expect("open");
+
+    git_run(&path, &["checkout", "-b", "feature"]);
+    std::fs::write(path.join("feature.txt"), "feature\n").expect("write");
+    commit_all(&repo, "feature commit");
+    git_run(&path, &["checkout", "main"]);
+    std::fs::write(path.join("main.txt"), "main\n").expect("write");
+    commit_all(&repo, "mainline commit");
+
+    assert_eq!(
+        repo.merge_base("feature", "main")
+            .expect("merge base")
+            .as_deref(),
+        Some(initial.as_str())
+    );
+
+    git_run(&path, &["checkout", "--orphan", "orphan"]);
+    std::fs::write(path.join("orphan.txt"), "orphan\n").expect("write");
+    commit_all(&repo, "orphan commit");
+    assert_eq!(repo.merge_base("orphan", "main").expect("ok"), None);
+
+    assert!(repo.merge_base("orphan", "no-such-ref").is_err());
+}
+
+#[test]
+fn split_patch_series_splits_real_multi_commit_mboxes() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let path = dir.path().join("repo");
+    let initial = Repo::init(&path, "My Repo", "desc").expect("init");
+    let repo = Repo::open(&path).expect("open");
+
+    git_run(&path, &["checkout", "-b", "feature"]);
+    std::fs::write(path.join("one.txt"), "one\n").expect("write");
+    commit_all(&repo, "first commit");
+    std::fs::write(path.join("two.txt"), "two\n").expect("write");
+    commit_all(&repo, "second commit");
+
+    let series = repo
+        .format_patch_between(&initial, "feature")
+        .expect("series");
+    let parts = PatchParser::split_patch_series(&series);
+
+    assert_eq!(parts.len(), 2);
+    assert!(parts[0].contains("Subject: [PATCH 1/2] first commit"));
+    assert!(parts[1].contains("Subject: [PATCH 2/2] second commit"));
+    let first = parts[0].lines().next().expect("first header");
+    let second = parts[1].lines().next().expect("second header");
+    assert!(first.starts_with("From ") && first.len() >= 45);
+    assert_ne!(first, second);
+}
+
+#[test]
+fn head_commit_and_commits_since_track_applied_commits() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let path = dir.path().join("repo");
+    let initial = Repo::init(&path, "My Repo", "desc").expect("init");
+    let repo = Repo::open(&path).expect("open");
+
+    assert_eq!(repo.head().as_deref(), Some(initial.as_str()));
+    assert_eq!(
+        repo.commits_since(None).expect("commits"),
+        vec![initial.clone()]
+    );
+
+    std::fs::write(path.join("one.txt"), "one\n").expect("write");
+    commit_all(&repo, "first commit");
+    let first = repo.head().expect("on a branch");
+
+    std::fs::write(path.join("two.txt"), "two\n").expect("write");
+    commit_all(&repo, "second commit");
+    let second = repo.head().expect("on a branch");
+
+    assert_eq!(
+        repo.commits_since(Some(&initial)).expect("commits"),
+        vec![first.clone(), second.clone()]
+    );
+    assert_eq!(
+        repo.commits_since(Some(&first)).expect("commits"),
+        vec![second]
+    );
+}
+
+#[test]
+fn working_copy_cloned_from_the_mirror_matches_head_and_origin() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let mirror = dir.path().join("mirror");
+    let commit = Repo::init(&mirror, "My Repo", "Does things.").expect("init");
+    Repo::open(&mirror)
+        .expect("open")
+        .ensure_origin("https://gitnostr.com/npub1test/my-repo.git")
+        .expect("origin");
+
+    let destination = dir.path().join("folder").join("My_Repo");
+    std::fs::create_dir_all(destination.parent().unwrap()).expect("parent");
+    Repo::clone(&[format!("file://{}", mirror.display())], &destination).expect("clone");
+    Repo::open(&destination)
+        .expect("open")
+        .set_origin("https://gitnostr.com/npub1test/my-repo.git")
+        .expect("set origin");
+    let working = Repo::open(&destination).expect("open");
+
+    assert_eq!(
+        working.origin_url().expect("url").as_deref(),
+        Some("https://gitnostr.com/npub1test/my-repo.git")
+    );
+    assert_eq!(working.head().as_deref(), Some(commit.as_str()));
+    assert!(destination.join("README.md").is_file());
+}
+
+#[test]
+fn fast_forward_branches_moves_the_mirror_and_keeps_local_work() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    bare_server(dir.path(), "npub1test", "repo");
+
+    let (work_dir, work_repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&work_repo, "initial");
+    let work = work_dir.path();
+    let base_url = format!("file://{}", dir.path().display());
+    work_repo
+        .push_all(&base_url, "npub1test", "repo")
+        .expect("push");
+
+    let mirror = dir.path().join("mirror");
+    git_run(
+        dir.path(),
+        &[
+            "clone",
+            "-q",
+            &format!("{base_url}/npub1test/repo.git"),
+            mirror.to_str().unwrap(),
+        ],
+    );
+    let initial = git_in(&mirror, &["rev-parse", "HEAD"]).expect("initial");
+    let repo = Repo::open(&mirror).expect("open");
+
+    std::fs::write(work.join("new.txt"), b"new\n").expect("write");
+    commit_all(&work_repo, "new commit");
+    work_repo
+        .push_all(&base_url, "npub1test", "repo")
+        .expect("push");
+    git_run(&mirror, &["fetch", "origin"]);
+    let remote = git_in(&mirror, &["rev-parse", "refs/remotes/origin/main"]).expect("remote");
+    assert_eq!(
+        git_in(&mirror, &["rev-parse", "HEAD"]).expect("local"),
+        initial
+    );
+    assert_ne!(remote, initial);
+
+    assert!(repo.fast_forward_branches().expect("ff"));
+    assert_eq!(
+        git_in(&mirror, &["rev-parse", "HEAD"]).expect("local"),
+        remote
+    );
+    assert!(mirror.join("new.txt").is_file());
+    assert!(!repo.fast_forward_branches().expect("idle"));
+
+    git_run(&mirror, &["checkout", "-b", "wip"]);
+    std::fs::write(mirror.join("wip.txt"), b"wip\n").expect("write");
+    commit_all(&repo, "local wip");
+    let wip = git_in(&mirror, &["rev-parse", "HEAD"]).expect("wip");
+    assert!(!repo.fast_forward_branches().expect("wip skipped"));
+    assert_eq!(
+        git_in(&mirror, &["rev-parse", "HEAD"]).expect("wip kept"),
+        wip
+    );
+}
+
+#[test]
+fn fetch_repo_refs_imports_heads_under_a_prefix() {
+    let dir = tempfile::tempdir().expect("tempdir");
+
+    let base_server = bare_server(dir.path(), "npub1base", "base");
+
+    let (upstream_dir, upstream_repo) = fixture(&[("a.txt", b"one")]);
+    commit_all(&upstream_repo, "initial");
+    let upstream_path = upstream_dir.path();
+    let initial = git_in(upstream_path, &["rev-parse", "HEAD"]).expect("initial");
+    upstream_repo
+        .push_all(
+            &format!("file://{}", dir.path().display()),
+            "npub1base",
+            "base",
+        )
+        .expect("push");
+
+    let base_url = format!("file://{}", base_server.display());
+    let mirror = dir.path().join("mirror");
+    git_run(
+        dir.path(),
+        &["clone", "-q", &base_url, mirror.to_str().unwrap()],
+    );
+    let mirror_repo = Repo::open(&mirror).expect("open");
+
+    let fork_work = dir.path().join("fork-work");
+    git_run(
+        dir.path(),
+        &["clone", "-q", &base_url, fork_work.to_str().unwrap()],
+    );
+    git_run(&fork_work, &["checkout", "-b", "feature"]);
+    std::fs::write(fork_work.join("feature.txt"), "feature\n").expect("write");
+    commit_all(&Repo::open(&fork_work).expect("open"), "feature commit");
+    let tip = git_in(&fork_work, &["rev-parse", "HEAD"]).expect("tip");
+
+    let fork_server = bare_server(dir.path(), "npub1fork", "fork");
+    Repo::open(&fork_work)
+        .expect("open")
+        .push_ref(
+            &format!("file://{}", fork_server.display()),
+            &tip,
+            "refs/heads/feature",
+        )
+        .expect("push");
+
+    let dead = format!("file://{}/missing.git", dir.path().display());
+    mirror_repo
+        .fetch_refs(
+            &[dead, format!("file://{}", fork_server.display())],
+            "+refs/heads/*:refs/fork/npub1fork/fork/*",
+        )
+        .expect("fetch");
+
+    assert_eq!(
+        mirror_repo
+            .refs_with_prefix("refs/fork/npub1fork/fork")
+            .expect("refs"),
+        vec!["refs/fork/npub1fork/fork/feature"]
+    );
+    assert_eq!(
+        mirror_repo
+            .refs_with_prefix("refs/heads/fork")
+            .expect("refs"),
+        Vec::<String>::new()
+    );
+
+    assert_eq!(
+        mirror_repo
+            .merge_base(
+                "refs/remotes/origin/main",
+                "refs/fork/npub1fork/fork/feature",
+            )
+            .expect("merge base")
+            .as_deref(),
+        Some(initial.as_str())
+    );
+    let patch = mirror_repo
+        .format_patch_between(&initial, "refs/fork/npub1fork/fork/feature")
+        .expect("patch");
+    assert!(patch.contains("Subject: [PATCH] feature commit"));
+    assert!(patch.contains("feature.txt"));
+
+    mirror_repo
+        .delete_refs_with_prefix("refs/fork/npub1fork/fork")
+        .expect("delete");
+    assert_eq!(
+        mirror_repo
+            .refs_with_prefix("refs/fork/npub1fork/fork")
+            .expect("refs"),
+        Vec::<String>::new()
+    );
+}
+
+/// Runs `git` in `dir`, failing the test on a non-zero exit.
+fn git_run(dir: &Path, args: &[&str]) -> std::process::Output {
+    let output = Command::new("git")
+        .current_dir(dir)
+        .env("GIT_AUTHOR_NAME", "Test Author")
+        .env("GIT_AUTHOR_EMAIL", "test@example.com")
+        .env("GIT_COMMITTER_NAME", "Test Author")
+        .env("GIT_COMMITTER_EMAIL", "test@example.com")
+        .env("GIT_EDITOR", "true")
+        .args(args)
+        .output()
+        .expect("spawn git");
+    assert!(output.status.success(), "git {args:?} failed");
+    output
+}
+
+#[test]
+fn find_git_repos_reports_the_outermost_repository() {
+    let root = tempfile::tempdir().expect("tempdir");
+    let repo_dir = root.path().join("project").join("sub");
+    std::fs::create_dir_all(&repo_dir).expect("mkdir");
+    git_run(&repo_dir, &["init", "-q"]);
+
+    let plain_dir = root.path().join("plain").join("deep");
+    std::fs::create_dir_all(&plain_dir).expect("mkdir");
+
+    let repos = find_git_repos(root.path());
+
+    assert_eq!(repos.len(), 1);
+    assert_eq!(repos[0].path, repo_dir.canonicalize().expect("canonical"));
+    assert!(repos[0].nip34.is_none());
+}
+
+#[test]
+fn find_git_repos_skips_repositories_nested_in_repositories() {
+    let root = tempfile::tempdir().expect("tempdir");
+    let outer = root.path().join("outer");
+    std::fs::create_dir_all(&outer).expect("mkdir");
+    git_run(&outer, &["init", "-q"]);
+
+    let nested = outer.join("nested");
+    std::fs::create_dir_all(&nested).expect("mkdir");
+    git_run(&nested, &["init", "-q"]);
+
+    let repos = find_git_repos(root.path());
+
+    assert_eq!(repos.len(), 1);
+    assert_eq!(repos[0].path, outer.canonicalize().expect("canonical"));
+}
+
+#[test]
+fn find_git_repos_ignores_a_repository_above_the_scan_root() {
+    let outer = tempfile::tempdir().expect("tempdir");
+    git_run(outer.path(), &["init", "-q"]);
+
+    let root = outer.path().join("scan");
+    std::fs::create_dir_all(&root).expect("mkdir");
+
+    assert!(find_git_repos(&root).is_empty());
+}
+
+/// Creates an empty bare server repository for push tests.
+fn bare_server(base: &Path, owner: &str, name: &str) -> PathBuf {
+    let repo = base.join(owner).join(format!("{name}.git"));
+    std::fs::create_dir_all(repo.parent().expect("parent")).expect("mkdir");
+    git_run(
+        base,
+        &["init", "--bare", "-q", repo.to_str().expect("utf8 path")],
+    );
+    repo
+}
+
+#[test]
+fn patch_commits_lists_every_patch_in_order() {
+    let patch = r#"From 1111111111111111111111111111111111111111 Mon Sep 17 00:00:00 2001
+From: Alice <alice@example.com>
+Date: Tue, 1 Aug 2023 10:00:00 +0200
+Subject: [PATCH 1/2] first
+
+body one
+---
+ a.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/a.txt b/a.txt
+@@ -1 +1,2 @@
+ a
++b
+
+From 2222222222222222222222222222222222222222 Mon Sep 17 00:00:00 2001
+From: Bob <bob@example.com>
+Date: Wed, 2 Aug 2023 11:30:00 +0000
+Subject: [PATCH 2/2] second
+
+body two
+---
+ b.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/b.txt b/b.txt
+@@ -1 +1,2 @@
+ x
++y
+"#;
+
+    let commits = PatchParser::patch_commits(patch);
+    assert_eq!(commits.len(), 2);
+
+    assert_eq!(commits[0].id, "1111111111111111111111111111111111111111");
+    assert_eq!(commits[0].summary, "first");
+    assert_eq!(commits[0].author, "Alice");
+    assert_eq!(commits[0].time, 1690876800);
+
+    assert_eq!(commits[1].id, "2222222222222222222222222222222222222222");
+    assert_eq!(commits[1].summary, "second");
+    assert_eq!(commits[1].author, "Bob");
+    assert_eq!(commits[1].time, 1690975800);
+}
+
+#[test]
+fn parses_real_format_patch_output() {
+    let (dir, repo) = fixture(&[
+        ("src/main.rs", b"fn main() {\n    println!(\"one\");\n}\n"),
+        ("my file.txt", b"hello\n"),
+        ("\u{8bf4}\u{660e}.md", "# \u{8bf4}\u{660e}\n".as_bytes()),
+        ("img.png", b"\x89PNG\r\n\x1a\n\x00binary"),
+    ]);
+    commit_all(&repo, "initial");
+
+    std::fs::write(
+        dir.path().join("src/main.rs"),
+        b"fn main() {\n    println!(\"two\");\n    println!(\"three\");\n}\n",
+    )
+    .expect("write");
+    std::fs::write(dir.path().join("my file.txt"), b"hello world\n").expect("write");
+    std::fs::write(
+        dir.path().join("\u{8bf4}\u{660e}.md"),
+        "# \u{8bf4}\u{660e}\nupdated\n",
+    )
+    .expect("write");
+    std::fs::remove_file(dir.path().join("img.png")).expect("remove");
+    std::fs::write(dir.path().join("new file.md"), b"# new\n").expect("write");
+    commit_all(&repo, "changes");
+
+    let output = git_run(dir.path(), &["format-patch", "-1", "--stdout"]);
+    let patch = String::from_utf8(output.stdout).expect("patch is utf-8");
+
+    let diff = PatchParser::patch_diffs(&patch).expect("parse real format-patch output");
+
+    let by_path = |path: &str| {
+        diff.files
+            .iter()
+            .find(|file| file.path == path)
+            .unwrap_or_else(|| panic!("missing file {path:?}"))
+    };
+
+    let file = by_path("my file.txt");
+    assert_eq!(file.status, DiffStatus::Modified);
+    assert_eq!(file.insertions, 1);
+
+    let file = by_path("\u{8bf4}\u{660e}.md");
+    assert_eq!(file.status, DiffStatus::Modified);
+    assert_eq!(file.insertions, 1);
+
+    let file = by_path("src/main.rs");
+    assert_eq!(file.status, DiffStatus::Modified);
+    assert_eq!(file.insertions, 2);
+    assert_eq!(file.deletions, 1);
+    assert!(!file.hunks.is_empty());
+
+    let file = by_path("new file.md");
+    assert_eq!(file.status, DiffStatus::Added);
+    assert_eq!(file.insertions, 1);
+
+    let file = by_path("img.png");
+    assert_eq!(file.status, DiffStatus::Deleted);
+    assert!(file.binary);
+    assert!(file.hunks.is_empty());
+    assert_eq!(file.insertions, 0);
+    assert_eq!(file.deletions, 0);
+}

crates/signed_git/src/worktree.rs

@@ -0,0 +1,36 @@
+use std::path::PathBuf;
+
+use crate::history::FileCommit;
+
+pub struct WorktreeSnapshot {
+    pub entries: Vec<PathBuf>,
+    pub readme_path: Option<PathBuf>,
+    pub readme: Option<Vec<u8>>,
+    pub current_branch: Option<String>,
+    pub head_commit: Option<FileCommit>,
+    pub branches: Vec<String>,
+    pub tags: Vec<String>,
+}
+
+impl WorktreeSnapshot {
+    /// Creates a snapshot of the worktree contents and ref state.
+    pub(crate) fn new(
+        entries: Vec<PathBuf>,
+        readme_path: Option<PathBuf>,
+        readme: Option<Vec<u8>>,
+        current_branch: Option<String>,
+        head_commit: Option<FileCommit>,
+        branches: Vec<String>,
+        tags: Vec<String>,
+    ) -> Self {
+        Self {
+            entries,
+            readme_path,
+            readme,
+            current_branch,
+            head_commit,
+            branches,
+            tags,
+        }
+    }
+}

crates/signed_nostr/Cargo.toml

@@ -5,18 +5,10 @@ edition.workspace = true
 publish.workspace = true
 
 [dependencies]
-signed_core = { path = "../signed_core" }
-
-nostr.workspace = true
 nostr-sdk.workspace = true
 nostr-connect.workspace = true
 nostr-gossip-memory.workspace = true
+nostr-lmdb.workspace = true
 
 anyhow.workspace = true
 webbrowser.workspace = true
-
-[target.'cfg(target_arch = "wasm32")'.dependencies]
-nostr-memory.workspace = true
-
-[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-nostr-lmdb.workspace = true

crates/signed_nostr/src/backend.rs

@@ -1,56 +1,47 @@
-#[cfg(not(target_arch = "wasm32"))]
 use std::path::Path;
 use std::time::Duration;
 
 use anyhow::{Context, Result};
 use nostr_gossip_memory::prelude::*;
-#[cfg(not(target_arch = "wasm32"))]
 use nostr_lmdb::prelude::*;
-#[cfg(target_arch = "wasm32")]
-use nostr_memory::prelude::*;
 use nostr_sdk::prelude::*;
 
 use crate::signer::UniversalSigner;
 
-/// Open (or create) the LMDB database at `db_path` and build a client
-/// configured for Signed, together with a fresh signer.
-///
-/// The SDK manages its own internal tokio runtime.
-/// the returned client can be driven by GPUI's executors.
-#[cfg(not(target_arch = "wasm32"))]
-pub async fn new_backend(db_path: impl AsRef<Path>) -> Result<(Client, UniversalSigner)> {
-    let signer = UniversalSigner::new(Keys::generate());
-    let database = NostrLmdb::open(db_path)
-        .await
-        .context("failed to open nostr database")?;
-    Ok(with_database(signer, database))
+pub struct NostrBackend {
+    pub client: Client,
+    pub signer: UniversalSigner,
 }
 
-/// In-memory database on wasm (no LMDB available).
-#[cfg(target_arch = "wasm32")]
-pub fn new_backend() -> Result<(Client, UniversalSigner)> {
-    let signer = UniversalSigner::new(Keys::generate());
-    Ok(with_database(signer, MemoryDatabase::unbounded()))
-}
+impl NostrBackend {
+    pub async fn open(db_path: impl AsRef<Path>) -> Result<Self> {
+        let db_path = db_path.as_ref();
+        let signer = UniversalSigner::new(Keys::generate());
+        let database = NostrLmdb::open(db_path)
+            .await
+            .context("failed to open nostr database")?;
+        Ok(Self::with_database(signer, database))
+    }
 
-fn with_database<D>(signer: UniversalSigner, database: D) -> (Client, UniversalSigner)
-where
-    D: IntoNostrDatabase,
-{
-    let authenticator = SignerAuthenticator::new(signer.clone());
+    fn with_database<D>(signer: UniversalSigner, database: D) -> Self
+    where
+        D: IntoNostrDatabase,
+    {
+        let authenticator = SignerAuthenticator::new(signer.clone());
 
-    let client = ClientBuilder::default()
-        .database(database)
-        .authenticator(authenticator)
-        .gossip(NostrGossipMemory::unbounded())
-        .gossip_config(GossipConfig::default().no_background_refresh())
-        .connect_timeout(Duration::from_secs(10))
-        .verify_subscriptions(true)
-        .ban_relay_on_mismatch(true)
-        .sleep_when_idle(SleepWhenIdle::Enabled {
-            timeout: Duration::from_secs(600),
-        })
-        .build();
+        let client = ClientBuilder::default()
+            .database(database)
+            .authenticator(authenticator)
+            .gossip(NostrGossipMemory::unbounded())
+            .gossip_config(GossipConfig::default().no_background_refresh())
+            .connect_timeout(Duration::from_secs(10))
+            .verify_subscriptions(true)
+            .ban_relay_on_mismatch(true)
+            .sleep_when_idle(SleepWhenIdle::Enabled {
+                timeout: Duration::from_secs(600),
+            })
+            .build();
 
-    (client, signer)
+        Self { client, signer }
+    }
 }

crates/signed_nostr/src/lib.rs

@@ -2,6 +2,6 @@ mod backend;
 mod signer;
 mod update;
 
-pub use backend::new_backend;
+pub use backend::NostrBackend;
 pub use signer::{SignedAuthUrlHandler, UniversalSigner};
 pub use update::Update;

crates/signed_nostr/src/signer.rs

@@ -5,34 +5,9 @@ use std::pin::Pin;
 use std::sync::{Arc, RwLock};
 
 use nostr_connect::client::AuthUrlHandler;
+use nostr_sdk::error::Error as SignerError;
 use nostr_sdk::prelude::*;
 
-#[derive(Debug)]
-pub struct UniversalSignerError(Box<dyn Error + Send + Sync + 'static>);
-
-impl fmt::Display for UniversalSignerError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", self.0)
-    }
-}
-
-impl Error for UniversalSignerError {
-    fn source(&self) -> Option<&(dyn Error + 'static)> {
-        Some(&*self.0)
-    }
-}
-
-impl UniversalSignerError {
-    pub fn new<E>(err: E) -> Self
-    where
-        E: Error + Send + Sync + 'static,
-    {
-        UniversalSignerError(Box::new(err))
-    }
-}
-
-/// A type-erased signer whose inner signer can be swapped in-place
-/// (e.g. after login/logout). All clones see the swap.
 #[derive(Clone, Debug)]
 pub struct UniversalSigner {
     inner: Arc<RwLock<Arc<dyn InnerSigner>>>,
@@ -51,7 +26,6 @@ impl UniversalSigner {
         }
     }
 
-    /// Swap the inner signer in-place. All clones see the new signer.
     pub fn swap_inner<T>(&self, new_signer: T)
     where
         T: AsyncGetPublicKey + AsyncSignEvent + AsyncNip44 + 'static,
@@ -66,21 +40,21 @@ impl UniversalSigner {
 trait InnerSigner: fmt::Debug + Send + Sync + 'static {
     fn get_public_key_async(
         &self,
-    ) -> Pin<Box<dyn Future<Output = Result<PublicKey, UniversalSignerError>> + Send + '_>>;
+    ) -> Pin<Box<dyn Future<Output = Result<PublicKey, SignerError>> + Send + '_>>;
     fn sign_event_async(
         &self,
         unsigned: UnsignedEvent,
-    ) -> Pin<Box<dyn Future<Output = Result<Event, UniversalSignerError>> + Send + '_>>;
+    ) -> Pin<Box<dyn Future<Output = Result<Event, SignerError>> + Send + '_>>;
     fn nip44_encrypt_async<'a>(
         &'a self,
         public_key: &'a PublicKey,
         content: &'a str,
-    ) -> Pin<Box<dyn Future<Output = Result<String, UniversalSignerError>> + Send + 'a>>;
+    ) -> Pin<Box<dyn Future<Output = Result<String, SignerError>> + Send + 'a>>;
     fn nip44_decrypt_async<'a>(
         &'a self,
         public_key: &'a PublicKey,
         payload: &'a str,
-    ) -> Pin<Box<dyn Future<Output = Result<String, UniversalSignerError>> + Send + 'a>>;
+    ) -> Pin<Box<dyn Future<Output = Result<String, SignerError>> + Send + 'a>>;
 }
 
 #[derive(Debug)]
@@ -95,22 +69,22 @@ where
 {
     fn get_public_key_async(
         &self,
-    ) -> Pin<Box<dyn Future<Output = Result<PublicKey, UniversalSignerError>> + Send + '_>> {
+    ) -> Pin<Box<dyn Future<Output = Result<PublicKey, SignerError>> + Send + '_>> {
         Box::pin(async move {
             AsyncGetPublicKey::get_public_key_async(&self.0)
                 .await
-                .map_err(UniversalSignerError::new)
+                .map_err(SignerError::other)
         })
     }
 
     fn sign_event_async(
         &self,
         unsigned: UnsignedEvent,
-    ) -> Pin<Box<dyn Future<Output = Result<Event, UniversalSignerError>> + Send + '_>> {
+    ) -> Pin<Box<dyn Future<Output = Result<Event, SignerError>> + Send + '_>> {
         Box::pin(async move {
             AsyncSignEvent::sign_event_async(&self.0, unsigned)
                 .await
-                .map_err(UniversalSignerError::new)
+                .map_err(SignerError::other)
         })
     }
 
@@ -118,11 +92,11 @@ where
         &'a self,
         public_key: &'a PublicKey,
         content: &'a str,
-    ) -> Pin<Box<dyn Future<Output = Result<String, UniversalSignerError>> + Send + 'a>> {
+    ) -> Pin<Box<dyn Future<Output = Result<String, SignerError>> + Send + 'a>> {
         Box::pin(async move {
             AsyncNip44::nip44_encrypt_async(&self.0, public_key, content)
                 .await
-                .map_err(UniversalSignerError::new)
+                .map_err(SignerError::other)
         })
     }
 
@@ -130,17 +104,17 @@ where
         &'a self,
         public_key: &'a PublicKey,
         payload: &'a str,
-    ) -> Pin<Box<dyn Future<Output = Result<String, UniversalSignerError>> + Send + 'a>> {
+    ) -> Pin<Box<dyn Future<Output = Result<String, SignerError>> + Send + 'a>> {
         Box::pin(async move {
             AsyncNip44::nip44_decrypt_async(&self.0, public_key, payload)
                 .await
-                .map_err(UniversalSignerError::new)
+                .map_err(SignerError::other)
         })
     }
 }
 
 impl AsyncGetPublicKey for UniversalSigner {
-    type Error = UniversalSignerError;
+    type Error = SignerError;
 
     fn get_public_key_async(
         &self,
@@ -151,7 +125,7 @@ impl AsyncGetPublicKey for UniversalSigner {
 }
 
 impl AsyncSignEvent for UniversalSigner {
-    type Error = UniversalSignerError;
+    type Error = SignerError;
 
     fn sign_event_async(
         &self,
@@ -163,7 +137,7 @@ impl AsyncSignEvent for UniversalSigner {
 }
 
 impl AsyncNip44 for UniversalSigner {
-    type Error = UniversalSignerError;
+    type Error = SignerError;
 
     fn nip44_encrypt_async<'a>(
         &'a self,
@@ -184,7 +158,6 @@ impl AsyncNip44 for UniversalSigner {
     }
 }
 
-/// Opens the NIP-46 auth URL in the default browser.
 #[derive(Debug, Clone)]
 pub struct SignedAuthUrlHandler;
 

crates/signed_nostr/src/update.rs

@@ -1,19 +1,13 @@
 use nostr_sdk::prelude::*;
 
-/// A lightweight "something changed" signal for the UI.
-///
-/// Heavy data stays in the database; consumers re-query on receipt.
 #[derive(Debug, Clone)]
 pub struct Update {
     pub kind: Kind,
-    /// First `a` tag value of the event, if any (e.g. the repository coordinate).
     pub coordinate: Option<Coordinate>,
     pub author: PublicKey,
-    pub event_id: EventId,
 }
 
 impl Update {
-    /// Build an update from a received event.
     pub fn from_event(event: &Event) -> Self {
         let coordinate = event.tags.coordinates().nth(0);
 
@@ -21,7 +15,6 @@ impl Update {
             kind: event.kind,
             coordinate,
             author: event.pubkey,
-            event_id: event.id,
         }
     }
 }

crates/signed_state/Cargo.toml

@@ -8,6 +8,7 @@ publish.workspace = true
 signed_core = { path = "../signed_core" }
 signed_git = { path = "../signed_git" }
 signed_nostr = { path = "../signed_nostr" }
+settings = { path = "../settings" }
 utils = { path = "../utils" }
 
 nostr.workspace = true
@@ -16,11 +17,16 @@ nostr-connect.workspace = true
 
 bitcoin_hashes = "1"
 
+gix.workspace = true
 gpui.workspace = true
 flume.workspace = true
 futures.workspace = true
 anyhow.workspace = true
 log.workspace = true
+serde_json.workspace = true
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 rustls = "0.23"
+
+[dev-dependencies]
+tempfile = "3"

crates/signed_state/src/bootstrap.rs

@@ -0,0 +1,87 @@
+use std::collections::HashMap;
+use std::time::Duration;
+
+use anyhow::Error;
+use nostr_connect::prelude::*;
+use nostr_sdk::client::SyncSummary;
+use nostr_sdk::prelude::*;
+use signed_core::Filters;
+
+pub const BOOTSTRAP_RELAYS: [&str; 2] = ["wss://relay.ditto.pub", "wss://index.ngit.dev"];
+pub const INDEXER_RELAYS: [&str; 2] = ["wss://indexer.coracle.social", "wss://user.kindpag.es"];
+
+pub(crate) async fn ensure_bootstrap_relays(client: &Client) -> Result<(), Error> {
+    for url in BOOTSTRAP_RELAYS {
+        client.add_relay(url).and_connect().await?;
+    }
+
+    for url in INDEXER_RELAYS {
+        client
+            .add_relay(url)
+            .capabilities(RelayCapabilities::DISCOVERY)
+            .and_connect()
+            .await?;
+    }
+
+    Ok(())
+}
+
+pub(crate) async fn subscribe_bootstrap_only(
+    client: &Client,
+    filters: Vec<Filter>,
+) -> Result<(), Error> {
+    ensure_bootstrap_relays(client).await?;
+
+    let opts = SubscribeAutoCloseOptions::default()
+        .exit_policy(ReqExitPolicy::ExitOnEOSE)
+        .timeout(Some(Duration::from_secs(10)));
+
+    let target: HashMap<&str, Vec<Filter>> = BOOTSTRAP_RELAYS
+        .iter()
+        .map(|relay| (*relay, filters.clone()))
+        .collect();
+
+    client.subscribe(target).close_on(opts).await?;
+
+    Ok(())
+}
+
+pub async fn sync_bootstrap_only(
+    client: &Client,
+    filter: Filter,
+    opts: SyncOptions,
+) -> Result<SyncSummary, Error> {
+    ensure_bootstrap_relays(client).await?;
+
+    let output = client
+        .sync(filter)
+        .with(BOOTSTRAP_RELAYS)
+        .opts(opts)
+        .await?;
+
+    Ok(output.value)
+}
+
+fn grasp_list_servers(event: &Event) -> Vec<RelayUrl> {
+    event
+        .tags
+        .iter()
+        .filter(|tag| tag.kind() == "g")
+        .filter_map(|tag| tag.content())
+        .filter_map(|url| RelayUrl::parse(url).ok())
+        .collect()
+}
+
+pub async fn user_grasp_list_servers(
+    client: &Client,
+    user: PublicKey,
+) -> Result<Vec<RelayUrl>, Error> {
+    let events: Vec<Event> = client
+        .database()
+        .query(Filters::grasp_list(user).limit(1))
+        .await?
+        .into_iter()
+        .collect();
+
+    Ok(events.first().map(grasp_list_servers).unwrap_or_default())
+}

crates/signed_state/src/checkouts.rs

@@ -0,0 +1,654 @@
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+use anyhow::Error;
+use gpui::{App, AppContext, Context, Entity, Global, Subscription};
+use nostr::prelude::*;
+use settings::{CheckoutRecord, CheckoutsSettings, SettingsStore};
+use signed_core::{Announcement, RepoAddr};
+use signed_git::Repo;
+use utils::same_repo_url;
+
+use crate::backend::{Backend, BackendEvent};
+use crate::git_store::Mirrors;
+use crate::local_repos::LocalReposStore;
+use crate::refresh::{RefreshGate, RefreshRequest};
+use crate::repos::RepoListStore;
+
+const REFRESH_DEBOUNCE: Duration = Duration::from_millis(300);
+const MAX_STATUS_CHECKOUTS: usize = 8;
+const LOCAL_POLL: Duration = Duration::from_secs(2);
+const STATUS_POLL: Duration = Duration::from_secs(15);
+const PUSH_POLL: Duration = Duration::from_secs(60);
+
+struct GlobalCheckoutsStore(Entity<CheckoutsStore>);
+
+impl Global for GlobalCheckoutsStore {}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CheckoutStatus {
+    pub path: PathBuf,
+    /// A detached checkout is idle and yields no status.
+    pub branch: String,
+    /// For tip-based PR dedupe.
+    pub head: String,
+    /// `refs/remotes/origin/<branch>`, else `origin/HEAD` for new branches.
+    pub base: String,
+    /// Zero-ahead checkouts are dropped, so always above zero.
+    pub ahead: u32,
+}
+
+struct Remembered {
+    path: PathBuf,
+    addr: RepoAddr,
+    last_used: u64,
+}
+
+impl Remembered {
+    fn resolve_associations<'a, A>(
+        remembered: &[Remembered],
+        scanned: &[(PathBuf, Option<String>, Option<String>)],
+        announcements: A,
+    ) -> HashMap<RepoAddr, Vec<PathBuf>>
+    where
+        A: IntoIterator<Item = &'a Announcement>,
+    {
+        let announcements: Vec<&Announcement> = announcements.into_iter().collect();
+        let mut out: HashMap<RepoAddr, Vec<PathBuf>> = HashMap::new();
+
+        let mut sorted: Vec<&Remembered> = remembered.iter().collect();
+        sorted.sort_by_key(|record| std::cmp::Reverse(record.last_used));
+        for record in sorted {
+            let paths = out.entry(record.addr.clone()).or_default();
+            if !paths.contains(&record.path) {
+                paths.push(record.path.clone());
+            }
+        }
+
+        for (path, origin, root) in scanned {
+            for announcement in &announcements {
+                let url_match = origin.as_deref().is_some_and(|origin| {
+                    announcement
+                        .clone
+                        .iter()
+                        .any(|url| same_repo_url(origin, url.as_str()))
+                });
+
+                let euc_match = root
+                    .as_deref()
+                    .is_some_and(|root| announcement.euc.as_deref() == Some(root));
+
+                if url_match || euc_match {
+                    let paths = out.entry(announcement.addr()).or_default();
+                    if !paths.contains(path) {
+                        paths.push(path.clone());
+                    }
+                }
+            }
+        }
+
+        out
+    }
+}
+
+pub struct CheckoutsStore {
+    by_repo: HashMap<RepoAddr, Vec<PathBuf>>,
+    statuses: HashMap<RepoAddr, Vec<CheckoutStatus>>,
+    status_requested: HashSet<RepoAddr>,
+    push_requested: HashSet<RepoAddr>,
+    push_statuses: HashMap<RepoAddr, Vec<CheckoutStatus>>,
+    requested_head: HashMap<RepoAddr, Option<String>>,
+    refresh: RefreshGate,
+    debounce_pending: bool,
+    local_pending: bool,
+    last_full_sync: Option<Instant>,
+    checkouts_settings: CheckoutsSettings,
+    _subscriptions: Vec<Subscription>,
+}
+
+impl CheckoutsStore {
+    pub fn global(cx: &App) -> Entity<Self> {
+        cx.global::<GlobalCheckoutsStore>().0.clone()
+    }
+
+    pub(crate) fn set_global(entity: Entity<Self>, cx: &mut App) {
+        cx.set_global(GlobalCheckoutsStore(entity));
+    }
+
+    pub fn new(cx: &mut Context<Self>) -> Self {
+        let mut subscriptions = Vec::new();
+        let mut checkouts_settings = CheckoutsSettings::default();
+
+        if !cfg!(target_arch = "wasm32") {
+            let settings = SettingsStore::global(cx);
+            let local = LocalReposStore::global(cx);
+            let repos = RepoListStore::global(cx);
+            let backend = Backend::global(cx);
+
+            checkouts_settings = settings.read(cx).settings().checkouts.clone();
+
+            subscriptions.push(cx.observe(&settings, |this, settings, cx| {
+                let checkouts = settings.read(cx).settings().checkouts.clone();
+                if this.checkouts_settings == checkouts {
+                    return;
+                }
+                // Only edits to the checkouts section affect the derived state
+                this.checkouts_settings = checkouts;
+                this.refresh(cx);
+            }));
+
+            subscriptions.push(cx.observe(&local, |this, _local, cx| {
+                this.refresh(cx);
+            }));
+
+            subscriptions.push(cx.observe(&repos, |this, _repos, cx| {
+                this.refresh(cx);
+            }));
+
+            // Another identity's repositories must not keep the old statuses alive.
+            subscriptions.push(cx.subscribe(&backend, |this, _backend, event, cx| {
+                if matches!(event, BackendEvent::SignerChanged) {
+                    this.status_requested.clear();
+                    this.push_requested.clear();
+                    this.requested_head.clear();
+                    this.statuses.clear();
+                    this.push_statuses.clear();
+                    cx.notify();
+
+                    this.refresh(cx);
+                }
+            }));
+        }
+
+        if !cfg!(target_arch = "wasm32") {
+            let weak = cx.entity().downgrade();
+            cx.defer(move |cx| {
+                weak.update(cx, |this, cx| {
+                    this.refresh(cx);
+                })
+                .ok();
+            });
+        }
+
+        Self {
+            by_repo: HashMap::new(),
+            statuses: HashMap::new(),
+            status_requested: HashSet::new(),
+            push_requested: HashSet::new(),
+            push_statuses: HashMap::new(),
+            requested_head: HashMap::new(),
+            refresh: RefreshGate::default(),
+            debounce_pending: false,
+            local_pending: false,
+            last_full_sync: None,
+            checkouts_settings,
+            _subscriptions: subscriptions,
+        }
+    }
+
+    pub fn record(&mut self, path: PathBuf, addr: RepoAddr, cx: &mut Context<Self>) {
+        if cfg!(target_arch = "wasm32") {
+            return;
+        }
+
+        let settings = SettingsStore::global(cx);
+        let addr_str = addr.to_string();
+
+        let last_used = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_secs())
+            .unwrap_or(0);
+
+        settings.update(cx, |settings, cx| {
+            settings.edit(
+                |s| {
+                    s.checkouts
+                        .records
+                        .retain(|r| !(r.path == path && r.addr == addr_str));
+                    s.checkouts.records.push(CheckoutRecord {
+                        path,
+                        addr: addr_str,
+                        last_used,
+                    });
+                },
+                cx,
+            );
+        });
+    }
+
+    pub fn associations_of(&self, addr: &RepoAddr) -> Vec<PathBuf> {
+        self.by_repo.get(addr).cloned().unwrap_or_default()
+    }
+
+    pub fn request_statuses(
+        &mut self,
+        addr: &RepoAddr,
+        announced_head: Option<String>,
+        cx: &mut Context<Self>,
+    ) {
+        self.status_requested.insert(addr.clone());
+        if announced_head != self.requested_head.get(addr).cloned().flatten() {
+            self.requested_head.insert(addr.clone(), announced_head);
+        }
+        self.refresh(cx);
+    }
+
+    pub fn ready_statuses_of(&self, addr: &RepoAddr) -> Vec<CheckoutStatus> {
+        self.statuses.get(addr).cloned().unwrap_or_default()
+    }
+
+    pub fn request_push_statuses(&mut self, addr: &RepoAddr, cx: &mut Context<Self>) {
+        self.push_requested.insert(addr.clone());
+        self.refresh(cx);
+    }
+
+    pub fn checkout_pushed(&mut self, addr: &RepoAddr, path: &Path, cx: &mut Context<Self>) {
+        let mut removed = false;
+
+        if let Some(statuses) = self.push_statuses.get_mut(addr) {
+            let before = statuses.len();
+            statuses.retain(|status| status.path.as_path() != path);
+            removed = statuses.len() != before;
+
+            if removed && statuses.is_empty() {
+                self.push_statuses.remove(addr);
+            }
+        }
+
+        if removed {
+            cx.notify();
+        }
+
+        self.request_push_statuses(addr, cx);
+    }
+
+    pub fn push_statuses_of(&self, addr: &RepoAddr) -> Vec<CheckoutStatus> {
+        self.push_statuses.get(addr).cloned().unwrap_or_default()
+    }
+
+    pub fn unpushed(&self, addr: &RepoAddr) -> usize {
+        self.push_statuses
+            .get(addr)
+            .map(|list| list.iter().map(|status| status.ahead as usize).sum())
+            .unwrap_or(0)
+    }
+
+    pub fn refresh(&mut self, cx: &mut Context<Self>) {
+        if self.debounce_pending || self.refresh.request() != RefreshRequest::Schedule {
+            return;
+        }
+
+        self.debounce_pending = true;
+
+        cx.spawn(async move |this, cx| {
+            cx.background_executor().timer(REFRESH_DEBOUNCE).await;
+            this.update(cx, |this, cx| {
+                this.run_refresh(cx);
+            })
+        })
+        .detach();
+    }
+
+    fn run_refresh(&mut self, cx: &mut Context<Self>) {
+        self.debounce_pending = false;
+        self.refresh.begin();
+
+        let records = {
+            let settings = SettingsStore::global(cx);
+            settings.read(cx).settings().checkouts.records.clone()
+        };
+
+        let remembered: Vec<Remembered> = records
+            .into_iter()
+            .filter_map(|record| {
+                let addr = record.addr.parse::<RepoAddr>().ok()?;
+                Some(Remembered {
+                    path: record.path,
+                    addr,
+                    last_used: record.last_used,
+                })
+            })
+            .collect();
+
+        let announcements = RepoListStore::global(cx).read(cx).announcements.clone();
+        let scanned = LocalReposStore::global(cx).read(cx).repos.clone();
+        let cache_root = Mirrors::root().canonicalize().ok();
+
+        let requested: Vec<(RepoAddr, Option<String>)> = self
+            .status_requested
+            .iter()
+            .map(|addr| {
+                (
+                    addr.clone(),
+                    self.requested_head.get(addr).cloned().flatten(),
+                )
+            })
+            .collect();
+
+        let push_requested: Vec<RepoAddr> = self.push_requested.iter().cloned().collect();
+        let poll = !self.status_requested.is_empty() || !self.push_requested.is_empty();
+
+        let work = cx.background_spawn(async move {
+            let mut facts: Vec<(PathBuf, Option<String>, Option<String>)> = Vec::new();
+            for scanned in scanned.iter() {
+                let path = &scanned.path;
+
+                // The browser's mirror clones are not user checkouts.
+                if cache_root
+                    .as_ref()
+                    .is_some_and(|root| path.starts_with(root))
+                {
+                    continue;
+                }
+
+                let origin = Repo::open(path)
+                    .and_then(|repo| repo.origin_url())
+                    .ok()
+                    .flatten();
+
+                let root = Repo::open(path)
+                    .and_then(|repo| repo.root_commit())
+                    .ok()
+                    .flatten();
+
+                facts.push((path.clone(), origin, root));
+            }
+
+            let associations =
+                Remembered::resolve_associations(&remembered, &facts, announcements.iter());
+
+            let associations: HashMap<RepoAddr, Vec<PathBuf>> = associations
+                .into_iter()
+                .map(|(addr, paths)| (addr, paths.into_iter().filter(|p| p.is_dir()).collect()))
+                .collect();
+
+            let (statuses, push_statuses) =
+                CheckoutsStore::compute_statuses(&associations, &requested, &push_requested, true);
+
+            Ok::<_, Error>((associations, statuses, push_statuses))
+        });
+
+        cx.spawn(async move |this, cx| {
+            let (associations, statuses, push_statuses) = match work.await {
+                Ok(results) => results,
+                Err(_) => {
+                    return this.update(cx, |this, cx| {
+                        this.refresh.abort();
+                        if poll {
+                            this.schedule_local_pass(cx);
+                        }
+                    });
+                }
+            };
+
+            let again = this.update(cx, |this, cx| {
+                let associations_changed = this.by_repo != associations;
+                let statuses_changed = this.statuses != statuses;
+                let push_statuses_changed = this.push_statuses != push_statuses;
+
+                this.by_repo = associations;
+                this.statuses = statuses;
+                this.push_statuses = push_statuses;
+
+                // Notify only when something actually changed.
+                if associations_changed || statuses_changed || push_statuses_changed {
+                    cx.notify();
+                }
+
+                this.last_full_sync = Some(Instant::now());
+                this.refresh.finish()
+            })?;
+
+            if again {
+                this.update(cx, |this, cx| {
+                    this.refresh(cx);
+                })?;
+            }
+
+            this.update(cx, |this, cx| {
+                if poll {
+                    this.schedule_local_pass(cx);
+                }
+            })?;
+
+            Ok(())
+        })
+        .detach();
+    }
+
+    fn schedule_local_pass(&mut self, cx: &mut Context<Self>) {
+        if self.local_pending {
+            return;
+        }
+        self.local_pending = true;
+
+        cx.spawn(async move |this, cx| {
+            cx.background_executor().timer(LOCAL_POLL).await;
+            this.update(cx, |this, cx| {
+                this.local_pending = false;
+                this.local_tick(cx);
+            })
+        })
+        .detach();
+    }
+
+    fn local_tick(&mut self, cx: &mut Context<Self>) {
+        if self.status_requested.is_empty() && self.push_requested.is_empty() {
+            return;
+        }
+
+        if self.refresh.running() || self.debounce_pending {
+            self.schedule_local_pass(cx);
+            return;
+        }
+
+        let cadence = if self.status_requested.is_empty() {
+            PUSH_POLL
+        } else {
+            STATUS_POLL
+        };
+
+        let full_due = self
+            .last_full_sync
+            .is_none_or(|sync| sync.elapsed() >= cadence);
+
+        if full_due {
+            self.last_full_sync = Some(Instant::now());
+            self.refresh(cx);
+        } else {
+            self.run_local_statuses(cx);
+        }
+
+        self.schedule_local_pass(cx);
+    }
+
+    fn run_local_statuses(&mut self, cx: &mut Context<Self>) {
+        let associations = self.by_repo.clone();
+
+        let requested: Vec<(RepoAddr, Option<String>)> = self
+            .status_requested
+            .iter()
+            .map(|addr| {
+                (
+                    addr.clone(),
+                    self.requested_head.get(addr).cloned().flatten(),
+                )
+            })
+            .collect();
+
+        let push_requested: Vec<RepoAddr> = self.push_requested.iter().cloned().collect();
+
+        let work = cx.background_spawn(async move {
+            let (statuses, push_statuses) =
+                CheckoutsStore::compute_statuses(&associations, &requested, &push_requested, false);
+            Ok::<_, Error>((statuses, push_statuses))
+        });
+
+        cx.spawn(async move |this, cx| {
+            let Ok((statuses, push_statuses)) = work.await else {
+                return Ok(());
+            };
+
+            this.update(cx, |this, cx| {
+                if this.refresh.running() || this.debounce_pending {
+                    return;
+                }
+
+                let statuses_changed = this.statuses != statuses;
+                let push_statuses_changed = this.push_statuses != push_statuses;
+
+                this.statuses = statuses;
+                this.push_statuses = push_statuses;
+
+                if statuses_changed || push_statuses_changed {
+                    cx.notify();
+                }
+            })?;
+
+            Ok::<(), anyhow::Error>(())
+        })
+        .detach();
+    }
+
+    fn checkout_status(path: &Path, announced_head: Option<&str>) -> Option<CheckoutStatus> {
+        let repo = Repo::try_open(path)?;
+        let branches = repo.branches().ok()?;
+
+        if branches.is_empty() || repo.is_dirty() {
+            return None;
+        }
+
+        let branch = repo.current_branch()?;
+        let head = repo.head()?;
+        let base = announced_head
+            .filter(|name| branches.iter().any(|b| b == name))
+            .map(str::to_owned)
+            .or_else(|| branches.iter().find(|b| *b == "main").cloned())
+            .or_else(|| branches.first().cloned())?;
+
+        if base == branch {
+            return None;
+        }
+
+        let ahead = repo.commits_ahead(&base, &branch);
+        (ahead > 0).then_some(CheckoutStatus {
+            path: path.to_path_buf(),
+            branch,
+            head,
+            base,
+            ahead,
+        })
+    }
+
+    /// Returns checkouts that are ahead of their remote tracking branch.
+    fn checkout_push_status(path: &Path, fetch: bool) -> Option<CheckoutStatus> {
+        let repo = Repo::try_open(path)?;
+        if repo.is_dirty() {
+            return None;
+        }
+
+        let branch = repo.current_branch()?;
+        let head = repo.head()?;
+        let origin = repo.origin_url().ok().flatten()?;
+
+        if fetch && let Err(e) = repo.fetch_refs(&[origin], "+refs/heads/*:refs/remotes/origin/*") {
+            log::warn!("failed to fetch refs for {path:?}: {e}");
+        }
+
+        let remote = format!("refs/remotes/origin/{branch}");
+
+        // If the branch is new and has no remote tracking branch, fall back to origin/HEAD.
+        let base = if repo.ref_exists(&remote) {
+            remote
+        } else if repo.ref_exists("refs/remotes/origin/HEAD") {
+            "refs/remotes/origin/HEAD".to_owned()
+        } else {
+            return None;
+        };
+
+        let ahead = repo.commits_ahead(&base, &branch);
+
+        (ahead > 0).then_some(CheckoutStatus {
+            path: path.to_path_buf(),
+            branch,
+            head,
+            base,
+            ahead,
+        })
+    }
+
+    fn compute_statuses(
+        associations: &HashMap<RepoAddr, Vec<PathBuf>>,
+        requested: &[(RepoAddr, Option<String>)],
+        push_requested: &[RepoAddr],
+        fetch: bool,
+    ) -> (
+        HashMap<RepoAddr, Vec<CheckoutStatus>>,
+        HashMap<RepoAddr, Vec<CheckoutStatus>>,
+    ) {
+        let mut statuses: HashMap<RepoAddr, Vec<CheckoutStatus>> = HashMap::new();
+        for (addr, announced_head) in requested {
+            let Some(paths) = associations.get(addr) else {
+                continue;
+            };
+
+            let list: Vec<CheckoutStatus> = paths
+                .iter()
+                .take(MAX_STATUS_CHECKOUTS)
+                .filter_map(|path| Self::checkout_status(path, announced_head.as_deref()))
+                .collect();
+
+            if !list.is_empty() {
+                statuses.insert(addr.clone(), list);
+            }
+        }
+
+        let mut push_statuses: HashMap<RepoAddr, Vec<CheckoutStatus>> = HashMap::new();
+        for addr in push_requested {
+            let Some(paths) = associations.get(addr) else {
+                continue;
+            };
+
+            let list: Vec<CheckoutStatus> = paths
+                .iter()
+                .take(MAX_STATUS_CHECKOUTS)
+                .filter_map(|path| Self::checkout_push_status(path, fetch))
+                .collect();
+
+            if !list.is_empty() {
+                push_statuses.insert(addr.clone(), list);
+            }
+        }
+
+        (statuses, push_statuses)
+    }
+
+    pub fn pr_proposes_checkout(
+        pr: &Event,
+        open: bool,
+        user: PublicKey,
+        checkout: &CheckoutStatus,
+    ) -> bool {
+        if pr.kind != Kind::GitPullRequest || !open || pr.pubkey != user {
+            return false;
+        }
+
+        let branch_matches = pr
+            .tags
+            .iter()
+            .find(|t| t.kind() == "branch-name")
+            .and_then(|t| t.content())
+            .is_some_and(|name| name == checkout.branch);
+
+        // A renamed branch falls back to the proposed tip commit.
+        let tip_matches = pr
+            .tags
+            .iter()
+            .find(|t| t.kind() == "c")
+            .and_then(|t| t.content())
+            .is_some_and(|tip| tip == checkout.head);
+
+        branch_matches || tip_matches
+    }
+}

crates/signed_state/src/git_store.rs

@@ -1,44 +1,41 @@
 use std::path::PathBuf;
+use std::sync::OnceLock;
 
-use gpui::{App, Global};
-use signed_git::GitCache;
+use anyhow::Result;
+use nostr::prelude::Url;
+use signed_core::RepoAddr;
+use signed_git::{GitCache, Repo};
 
-struct GlobalGitStore(GitCache);
+static GIT_CACHE: OnceLock<GitCache> = OnceLock::new();
 
-impl Global for GlobalGitStore {}
+pub struct Mirrors;
 
-/// Global access to the on-disk git clone cache (grasp mirrors).
-///
-/// Installed at startup via [`GitStore::set_global`]; see also
-/// [`signed_state::init`].
-#[derive(Debug, Clone)]
-pub struct GitStore(GitCache);
-
-impl GitStore {
-    /// Register the clone cache rooted at `root` as an app-wide global.
-    /// Replaces any previously installed store (see [`signed_state::init`], which
-    /// installs an empty one).
-    pub fn set_global(root: impl Into<PathBuf>, cx: &mut App) -> Self {
-        let store = Self::new(root);
-        cx.set_global(GlobalGitStore(store.0.clone()));
-        store
+impl Mirrors {
+    pub fn install(root: impl Into<PathBuf>) {
+        if GIT_CACHE.set(GitCache::new(root.into())).is_err() {
+            log::warn!("git cache root is already set, keeping the first one");
+        }
     }
 
-    /// The app-wide clone cache.
-    ///
-    /// # Panics
-    ///
-    /// Panics if [`GitStore::set_global`] was never called.
-    pub fn global(cx: &App) -> Self {
-        Self(cx.global::<GlobalGitStore>().0.clone())
+    fn cache() -> &'static GitCache {
+        GIT_CACHE
+            .get()
+            .expect("git cache is initialized by signed_state::init")
     }
 
-    fn new(root: impl Into<PathBuf>) -> Self {
-        Self(GitCache::new(root.into()))
+    pub(crate) fn root() -> PathBuf {
+        Self::cache().root().to_path_buf()
     }
 
-    /// Underlying clone cache.
-    pub fn cache(&self) -> &GitCache {
-        &self.0
+    pub fn path(addr: &RepoAddr) -> PathBuf {
+        Self::cache().repo_path(addr)
+    }
+
+    pub fn open(addr: &RepoAddr) -> Result<Option<Repo>> {
+        Self::cache().open(addr)
+    }
+
+    pub fn ensure(addr: &RepoAddr, clone_urls: &[Url]) -> Result<Repo> {
+        Self::cache().ensure_clone(addr, clone_urls)
     }
 }

crates/signed_state/src/inbox.rs

@@ -0,0 +1,230 @@
+use std::collections::{HashMap, HashSet};
+
+use anyhow::Error;
+use gpui::{AppContext, Context, Task};
+use nostr_sdk::prelude::*;
+use signed_core::{Deletions, Filters, GitEvent, InboxItem, InboxReadState, inbox};
+
+use crate::backend::Backend;
+
+#[derive(Default)]
+pub struct Inbox {
+    state: InboxReadState,
+    loaded: bool,
+}
+
+impl Inbox {
+    pub fn state(&self) -> &InboxReadState {
+        &self.state
+    }
+
+    pub fn is_loaded(&self) -> bool {
+        self.loaded
+    }
+
+    pub fn mark_all_read(&mut self, all: &[Event], me: PublicKey, cx: &mut Context<Self>) {
+        self.state.mark_all_read(all, me, Timestamp::now());
+        self.persist(cx);
+        cx.notify();
+    }
+
+    pub(crate) fn activate(&mut self, me: PublicKey, client: Client, cx: &mut Context<Self>) {
+        self.state = InboxReadState::default();
+        self.loaded = false;
+        cx.notify();
+
+        let backend = Backend::global(cx);
+        let work = cx.background_spawn(async move { Self::load_state(&client, me).await });
+
+        cx.spawn(async move |this, cx| {
+            let loaded = work.await;
+
+            this.update(cx, |this, cx| {
+                if backend.read(cx).current_user() != Some(me) {
+                    return;
+                }
+
+                match loaded {
+                    Ok(Some(state)) => this.state = state,
+                    Ok(None) => this.state = InboxReadState::default(),
+                    Err(error) => log::warn!("failed to load inbox state: {error}"),
+                }
+
+                this.loaded = true;
+                cx.notify();
+            })?;
+
+            Ok::<(), Error>(())
+        })
+        .detach();
+    }
+
+    pub(crate) fn reset(&mut self, cx: &mut Context<Self>) {
+        self.state = InboxReadState::default();
+        self.loaded = false;
+        cx.notify();
+    }
+
+    fn persist(&mut self, cx: &mut Context<Self>) {
+        let backend = Backend::global(cx);
+        let (me, client) = {
+            let backend = backend.read(cx);
+            (backend.current_user(), backend.client())
+        };
+
+        let Some(me) = me else {
+            return;
+        };
+
+        let state = self.state.clone();
+
+        let task: Task<Result<(), Error>> = cx.background_spawn(async move {
+            if let Err(error) = Self::save_state(&client, me, &state).await {
+                log::warn!("failed to save inbox state: {error}");
+            }
+            Ok(())
+        });
+
+        task.detach();
+    }
+
+    pub async fn query(
+        client: &Client,
+        me: PublicKey,
+        state: &InboxReadState,
+    ) -> Result<(Vec<InboxItem>, usize), Error> {
+        let deletion_events = client.database().query(Filters::deletions()).await?;
+        let deletions = Deletions::from_events(deletion_events);
+
+        let (notification_events, mut by_id) =
+            Self::fetch_notifications(client, me, &deletions).await?;
+
+        let mut activity = Vec::new();
+        for event in client
+            .database()
+            .query(Filters::authored_activity(me))
+            .await?
+        {
+            if deletions.is_deleted(&event) || !event.is_git_activity() {
+                continue;
+            }
+            by_id.entry(event.id).or_insert_with(|| event.clone());
+            activity.push(event);
+        }
+
+        let items = inbox::group(notification_events, activity, me, state, &|id| {
+            by_id.get(&id).cloned()
+        });
+
+        let unread_count = items.iter().filter(|item| item.is_unread()).count();
+
+        Ok((items, unread_count))
+    }
+}
+
+impl Inbox {
+    fn inbox_state_d_tag(me: PublicKey) -> String {
+        format!("signed-inbox-state:{}", me.to_hex())
+    }
+
+    async fn load_state(client: &Client, me: PublicKey) -> Result<Option<InboxReadState>, Error> {
+        let filter = Filter::new()
+            .kind(Kind::ApplicationSpecificData)
+            .identifier(Self::inbox_state_d_tag(me));
+
+        let events = client.database().query(filter).await?;
+
+        let Some(event) = events.into_iter().max_by_key(|event| event.created_at) else {
+            return Ok(None);
+        };
+
+        match serde_json::from_str(&event.content) {
+            Ok(state) => Ok(Some(state)),
+            Err(error) => {
+                log::warn!("ignoring unreadable inbox state {}: {error}", event.id);
+                Ok(None)
+            }
+        }
+    }
+
+    // Signed with a random key: the state is local-only, authorship does not
+    // matter and no key material needs to be kept.
+    async fn save_state(
+        client: &Client,
+        me: PublicKey,
+        state: &InboxReadState,
+    ) -> Result<(), Error> {
+        let event = EventBuilder::new(Kind::ApplicationSpecificData, serde_json::to_string(state)?)
+            .tags([Tag::identifier(Self::inbox_state_d_tag(me))])
+            .finalize(&Keys::generate())?;
+
+        client.database().save_event(&event).await?;
+
+        Ok(())
+    }
+
+    async fn fetch_notifications(
+        client: &Client,
+        me: PublicKey,
+        deletions: &Deletions,
+    ) -> Result<(Vec<Event>, HashMap<EventId, Event>), Error> {
+        let mut notifications: Vec<Event> = Vec::new();
+        let mut by_id: HashMap<EventId, Event> = HashMap::new();
+
+        for filter in Filters::notifications(me) {
+            for event in client.database().query(filter).await? {
+                if deletions.is_deleted(&event) {
+                    continue;
+                }
+
+                if by_id.insert(event.id, event.clone()).is_none() {
+                    notifications.push(event);
+                }
+            }
+        }
+
+        let mut pending: Vec<EventId> = notifications
+            .iter()
+            .flat_map(Self::event_references)
+            .collect();
+
+        let mut seen: HashSet<EventId> = by_id.keys().copied().collect();
+
+        loop {
+            pending.retain(|id| seen.insert(*id));
+
+            if pending.is_empty() {
+                break;
+            }
+
+            let ancestors = client
+                .database()
+                .query(Filter::new().ids(pending.iter().copied()))
+                .await?;
+
+            let mut next = Vec::new();
+
+            for event in ancestors {
+                if deletions.is_deleted(&event) {
+                    continue;
+                }
+                next.extend(Self::event_references(&event).filter(|id| !seen.contains(id)));
+                by_id.entry(event.id).or_insert(event);
+            }
+
+            pending = next;
+        }
+
+        Ok((notifications, by_id))
+    }
+
+    fn event_references(event: &Event) -> impl Iterator<Item = EventId> + '_ {
+        event.tags.iter().filter_map(|tag| {
+            if tag.kind() != "e" && tag.kind() != "E" {
+                return None;
+            }
+            tag.content()
+                .and_then(|content| EventId::from_hex(content).ok())
+        })
+    }
+}

crates/signed_state/src/lib.rs

@@ -1,67 +1,56 @@
 mod backend;
+mod bootstrap;
+mod checkouts;
 mod git_store;
+mod inbox;
 mod local_repos;
-mod profile;
+mod patch_series;
+mod push;
+mod refresh;
 mod repo;
-mod repo_list;
+mod repos;
+mod state;
+mod sync_status;
 
 use std::path::{Path, PathBuf};
 
 pub use backend::{Backend, BackendEvent};
-pub use git_store::GitStore;
-use gpui::{App, AppContext, Entity};
-pub use local_repos::LocalReposStore;
+pub use bootstrap::{sync_bootstrap_only, user_grasp_list_servers};
+pub use checkouts::{CheckoutStatus, CheckoutsStore};
+pub use git_store::Mirrors;
+use gpui::{App, AppContext};
+pub use inbox::Inbox;
+pub use local_repos::{LocalReposStore, ResolvedLocalRepo};
 pub use nostr_sdk::prelude::Timestamp;
-pub use profile::{Profile, ProfileStore};
+pub use push::{GraspServer, PushOutcome};
+pub use refresh::{RefreshGate, RefreshRequest};
 pub use repo::RepoStore;
-pub use repo_list::{RepoActivityCounts, RepoListStore};
-use signed_nostr::new_backend;
-pub use utils::shorten_pubkey;
+pub use repos::RepoListStore;
+pub use signed_git::{Nip34Binding, Nip34Kind};
+use signed_nostr::NostrBackend;
+pub use state::{GitPushMode, GitPushPolicy, GitRef, PushStep, PushStepStatus, SyncState};
+pub use sync_status::{CheckoutSyncStatus, SyncEvent, SyncStatusDirectory, SyncStatusStore};
 
-/// Initialize the backend and stores, and install them as globals.
-/// Call once at startup, before opening any window that uses the stores.
-#[cfg(not(target_arch = "wasm32"))]
-pub fn init(db_path: impl AsRef<Path>, scan_paths: Vec<PathBuf>, cx: &mut App) -> Entity<Backend> {
-    // rustls uses the `aws_lc_rs` provider by default; ignore if already installed.
-    rustls::crypto::aws_lc_rs::default_provider()
-        .install_default()
-        .ok();
+pub fn init(
+    db_path: impl AsRef<Path>,
+    repos_root: impl Into<PathBuf>,
+    scan_paths: Vec<PathBuf>,
+    cx: &mut App,
+) {
+    // rustls uses the `aws_lc_rs` provider by default.
+    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
 
-    let (client, signer) = cx.foreground_executor().block_on(async move {
-        let path = db_path.as_ref().to_path_buf();
-        new_backend(path)
-            .await
-            .expect("failed to initialize nostr backend")
-    });
+    let backend = cx
+        .foreground_executor()
+        .block_on(async move { NostrBackend::open(db_path.as_ref()).await });
+    let backend = backend.expect("failed to initialize nostr backend");
+    let (client, signer) = (backend.client, backend.signer);
 
-    let entity = cx.new(|cx| Backend::new(client, signer, cx));
-    Backend::set_global(entity.clone(), cx);
-    ProfileStore::set_global(cx.new(ProfileStore::new), cx);
-
-    // Seed the explore list from the local database; relay syncs continue
-    // in the background.
-    RepoListStore::set_global(cx.new(|cx| RepoListStore::new(None, cx)), cx);
-
-    // The clone cache is native-only; wasm registers an empty store so
-    // `GitStore::global` still works.
-    GitStore::set_global(PathBuf::new(), cx);
+    Mirrors::install(repos_root);
 
+    Backend::set_global(cx.new(|cx| Backend::new(client, signer, cx)), cx);
+    RepoListStore::set_global(cx.new(RepoListStore::new), cx);
     LocalReposStore::set_global(cx.new(|cx| LocalReposStore::new(scan_paths, cx)), cx);
-
-    entity
-}
-
-/// Initialize the backend with an in-memory database on wasm.
-#[cfg(target_arch = "wasm32")]
-pub fn init(cx: &mut App) -> Entity<Backend> {
-    let (client, signer) = new_backend().expect("failed to initialize nostr backend");
-
-    let entity = cx.new(|cx| Backend::new(client, signer, cx));
-    Backend::set_global(entity.clone(), cx);
-    ProfileStore::set_global(cx.new(ProfileStore::new), cx);
-    RepoListStore::set_global(cx.new(|cx| RepoListStore::new(None, cx)), cx);
-    GitStore::set_global(PathBuf::new(), cx);
-    LocalReposStore::set_global(cx.new(|cx| LocalReposStore::new(Vec::new(), cx)), cx);
-
-    entity
+    CheckoutsStore::set_global(cx.new(CheckoutsStore::new), cx);
+    SyncStatusStore::set_global(cx.new(SyncStatusStore::new), cx);
 }

crates/signed_state/src/local_repos.rs

@@ -1,29 +1,24 @@
+use std::collections::HashSet;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use anyhow::Error;
-use gpui::{App, AppContext, Context, Entity, Global, Task};
-use signed_git::find_git_repos;
+use gpui::{App, AppContext, Context, Entity, Global, SharedString, Task};
+use signed_core::{Announcement, RepoAddr};
+use signed_git::{LocalRepo, Nip34Binding, find_git_repos};
 
 struct GlobalLocalReposStore(Entity<LocalReposStore>);
 
 impl Global for GlobalLocalReposStore {}
 
-/// Store of the git repositories discovered under a set of scan paths.
 pub struct LocalReposStore {
-    /// The directories being scanned.
     pub roots: Arc<Vec<PathBuf>>,
-    /// Git repositories discovered under [`Self::roots`], sorted by path.
-    pub repos: Arc<Vec<PathBuf>>,
-    /// A scan is currently running.
+    pub repos: Arc<Vec<LocalRepo>>,
     pub scanning: bool,
-    /// A scan was requested while one was already running.
     scan_dirty: bool,
-    tasks: Vec<Task<Result<(), Error>>>,
 }
 
 impl LocalReposStore {
-    /// Retrieve the global local-repositories store.
     pub fn global(cx: &App) -> Entity<Self> {
         cx.global::<GlobalLocalReposStore>().0.clone()
     }
@@ -32,39 +27,39 @@ impl LocalReposStore {
         cx.set_global(GlobalLocalReposStore(entity));
     }
 
-    /// Create a store scanning `roots` right away.
     pub fn new(roots: Vec<PathBuf>, cx: &mut Context<Self>) -> Self {
-        let mut store = Self {
+        let weak = cx.entity().downgrade();
+        cx.defer(move |cx| {
+            if let Err(error) = weak.update(cx, |this, cx| this.rescan(cx)) {
+                log::warn!("local repos store dropped before initial scan could run: {error}");
+            }
+        });
+
+        Self {
             roots: Arc::new(roots),
             repos: Arc::new(Vec::new()),
             scanning: false,
             scan_dirty: false,
-            tasks: Vec::new(),
-        };
-        store.rescan(cx);
-        store
+        }
     }
 
-    /// Forget a repository that has just been published to NIP-34,
-    /// so it leaves the local list immediately. A later rescan re-discovers it from disk,
-    /// the sidebar additionally hides published repositories by identifier.
     pub fn remove(&mut self, path: &Path, cx: &mut Context<Self>) {
         self.repos = Arc::new(
             self.repos
                 .iter()
-                .filter(|repo| repo.as_path() != path)
+                .filter(|repo| repo.path.as_path() != path)
                 .cloned()
                 .collect(),
         );
         cx.notify();
     }
 
-    /// Re-run the scan.
     pub fn rescan(&mut self, cx: &mut Context<Self>) {
         if self.scanning {
             self.scan_dirty = true;
             return;
         }
+
         if self.roots.is_empty() {
             return;
         }
@@ -73,17 +68,18 @@ impl LocalReposStore {
         cx.notify();
 
         let roots = self.roots.clone();
+
         let work = cx.background_spawn(async move {
             let mut repos = Vec::new();
             for root in roots.iter() {
                 repos.extend(find_git_repos(root));
             }
-            repos.sort();
-            repos.dedup();
+            repos.sort_by(|a, b| a.path.cmp(&b.path));
+            repos.dedup_by(|a, b| a.path == b.path);
             repos
         });
 
-        self.tasks.push(cx.spawn(async move |this, cx| {
+        let task: Task<Result<(), Error>> = cx.spawn(async move |this, cx| {
             let repos = work.await;
             let again = this.update(cx, |this, cx| {
                 this.repos = Arc::new(repos);
@@ -95,13 +91,139 @@ impl LocalReposStore {
                 dirty
             })?;
 
-            // Scans requested while this one was running are coalesced into
-            // a single follow-up scan.
             if again {
                 this.update(cx, |this, cx| this.rescan(cx))?;
             }
 
             Ok(())
-        }));
+        });
+
+        task.detach();
+    }
+}
+
+pub fn local_repo_addr(repo: &LocalRepo) -> Option<RepoAddr> {
+    let binding = repo.nip34.as_ref()?;
+    let owner = binding.owner?;
+    let identifier = binding.identifier.as_deref()?;
+
+    Some(RepoAddr::new(owner, identifier))
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct ResolvedLocalRepo {
+    pub path: PathBuf,
+    pub nip34: Option<Nip34Binding>,
+    pub announcement: Option<Announcement>,
+}
+
+impl ResolvedLocalRepo {
+    pub fn name(&self) -> SharedString {
+        self.path
+            .file_name()
+            .map(|name| SharedString::from(name.to_string_lossy().into_owned()))
+            .unwrap_or_else(|| SharedString::from("Untitled"))
+    }
+}
+
+impl LocalReposStore {
+    pub fn resolve(
+        repos: &[LocalRepo],
+        known: &[Announcement],
+        own: &[Announcement],
+    ) -> Vec<ResolvedLocalRepo> {
+        let shown: HashSet<RepoAddr> = own.iter().map(Announcement::addr).collect();
+
+        repos
+            .iter()
+            .filter_map(|repo| {
+                let addr = local_repo_addr(repo);
+
+                if let Some(addr) = &addr
+                    && shown.contains(addr)
+                {
+                    return None;
+                }
+
+                let announcement = addr
+                    .as_ref()
+                    .and_then(|addr| {
+                        known
+                            .iter()
+                            .find(|announcement| announcement.addr() == *addr)
+                    })
+                    .cloned();
+
+                Some(ResolvedLocalRepo {
+                    path: repo.path.clone(),
+                    nip34: repo.nip34.clone(),
+                    announcement,
+                })
+            })
+            .collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use nostr::prelude::*;
+    use signed_git::{GraspSignals, Nip34Kind};
+
+    use super::*;
+
+    const KEY: &str = "0000000000000000000000000000000000000000000000000000000000000001";
+    const OTHER_KEY: &str = "0000000000000000000000000000000000000000000000000000000000000002";
+
+    fn announcement(secret: &str, id: &str) -> Announcement {
+        let keys = Keys::new(SecretKey::from_hex(secret).expect("secret"));
+        let tag = Tag::parse(vec!["d", id]).expect("tag");
+        let event = EventBuilder::new(Kind::GitRepoAnnouncement, "")
+            .tags(vec![tag])
+            .finalize(&keys)
+            .expect("signed");
+
+        Announcement::from_event(&event).expect("parsed")
+    }
+
+    fn owner(secret: &str) -> PublicKey {
+        Keys::new(SecretKey::from_hex(secret).expect("secret")).public_key()
+    }
+
+    fn bound(secret: &str, id: &str) -> LocalRepo {
+        let binding = Nip34Binding {
+            kind: Nip34Kind::Initialized,
+            signals: GraspSignals {
+                nip34_json: true,
+                ..Default::default()
+            },
+            owner: Some(owner(secret)),
+            identifier: Some(id.to_owned()),
+            grasp_urls: Vec::new(),
+        };
+
+        LocalRepo {
+            path: PathBuf::from(id),
+            nip34: Some(binding),
+        }
+    }
+
+    #[test]
+    fn the_users_own_announcement_is_dropped() {
+        let own = announcement(KEY, "mine");
+        let repo = bound(KEY, "mine");
+
+        let own = std::slice::from_ref(&own);
+        assert!(LocalReposStore::resolve(&[repo], own, own).is_empty());
+    }
+
+    #[test]
+    fn another_owners_announcement_is_linked_and_kept() {
+        let known = announcement(OTHER_KEY, "theirs");
+        let repo = bound(OTHER_KEY, "theirs");
+
+        let resolved = LocalReposStore::resolve(&[repo], std::slice::from_ref(&known), &[]);
+
+        assert_eq!(resolved.len(), 1);
+        assert_eq!(resolved[0].announcement.as_ref(), Some(&known));
     }
 }

crates/signed_state/src/patch_series.rs

@@ -0,0 +1,50 @@
+use bitcoin_hashes::sha1::Hash as Sha1Hash;
+use signed_git::PatchParser;
+
+/// NIP-34 suggests patches when each event is under 60kb.
+pub(crate) const MAX_PATCH_EVENT_BYTES: usize = 60 * 1024;
+
+pub(crate) struct PatchSeries {
+    pub(crate) parts: Vec<String>,
+}
+
+impl PatchSeries {
+    pub(crate) fn parse(patch: &str) -> Self {
+        Self {
+            parts: PatchParser::split_patch_series(patch)
+                .into_iter()
+                .map(str::to_owned)
+                .collect(),
+        }
+    }
+
+    /// Returns the length of the first part that exceeds the NIP-34 recommended size.
+    pub(crate) fn oversized_length(&self) -> Option<usize> {
+        self.parts
+            .iter()
+            .map(String::len)
+            .find(|length| *length > MAX_PATCH_EVENT_BYTES)
+    }
+
+    /// The last commit of the series, which is the tip of the branch.
+    pub(crate) fn tip_commit(&self) -> Option<Sha1Hash> {
+        self.parts
+            .last()
+            .and_then(|part| patch_current_commit(part))
+            .and_then(|hex| hex.parse::<Sha1Hash>().ok())
+    }
+
+    pub(crate) fn commit_of(&self, index: usize) -> Option<&str> {
+        self.parts
+            .get(index)
+            .and_then(|part| patch_current_commit(part))
+            .filter(|hex| hex.len() == 40)
+    }
+}
+
+/// The `From <commit>` header on the first line.
+fn patch_current_commit(patch: &str) -> Option<&str> {
+    let line = patch.lines().next()?;
+    let hex = line.strip_prefix("From ")?;
+    hex.split_whitespace().next().filter(|hex| hex.len() == 40)
+}

crates/signed_state/src/profile.rs

@@ -1,329 +0,0 @@
-use std::cell::RefCell;
-use std::collections::{HashMap, HashSet};
-use std::time::{Duration, Instant};
-
-use anyhow::Error;
-use flume::{Receiver, RecvTimeoutError, Sender};
-use gpui::{App, AppContext, Context, Entity, Global, SharedString, Subscription, Task};
-use nostr_sdk::prelude::*;
-use utils::shorten_pubkey;
-
-use crate::backend::{Backend, BackendEvent, sync_bootstrap_only};
-
-/// A user profile (kind `0` metadata), as plain data for the UI.
-#[derive(Debug, Clone)]
-pub struct Profile {
-    public_key: PublicKey,
-    metadata: Metadata,
-}
-
-impl Profile {
-    pub fn new(public_key: PublicKey, metadata: Metadata) -> Self {
-        Self {
-            public_key,
-            metadata,
-        }
-    }
-
-    pub fn public_key(&self) -> PublicKey {
-        self.public_key
-    }
-
-    pub fn metadata(&self) -> &Metadata {
-        &self.metadata
-    }
-
-    /// Display name, falling back to `name`, then a shortened npub.
-    pub fn name(&self) -> SharedString {
-        if let Some(display_name) = self.metadata.display_name.as_ref()
-            && !display_name.is_empty()
-        {
-            return SharedString::from(display_name.trim().to_owned());
-        }
-
-        if let Some(name) = self.metadata.name.as_ref()
-            && !name.is_empty()
-        {
-            return SharedString::from(name.trim().to_owned());
-        }
-
-        SharedString::from(shorten_pubkey(self.public_key, 4))
-    }
-
-    /// Avatar URL, if set.
-    pub fn picture(&self) -> Option<SharedString> {
-        self.metadata
-            .picture
-            .as_ref()
-            .filter(|p| !p.is_empty())
-            .map(|p| SharedString::from(p.clone()))
-    }
-}
-
-/// Message from the fetch task to the main thread.
-enum Dispatch {
-    /// A batched sync finished; re-read seen profiles from the database.
-    Synced,
-}
-
-/// How long to wait for more requests before firing a batched sync.
-const BATCH_TIMEOUT: Duration = Duration::from_millis(500);
-
-/// Global profile cache. Profiles are fetched in batches and kept as plain
-/// data; the whole store notifies on change.
-pub struct ProfileStore {
-    profiles: HashMap<PublicKey, Profile>,
-    /// Public keys we've already requested this session (main thread only).
-    seen: RefCell<HashSet<PublicKey>>,
-    /// Sender for queuing fetch requests, batched by a background task.
-    sender: Sender<PublicKey>,
-    tasks: Vec<Task<Result<(), Error>>>,
-    _subscription: Subscription,
-}
-
-struct GlobalProfileStore(Entity<ProfileStore>);
-
-impl Global for GlobalProfileStore {}
-
-impl ProfileStore {
-    /// Retrieve the global profile store.
-    pub fn global(cx: &App) -> Entity<Self> {
-        cx.global::<GlobalProfileStore>().0.clone()
-    }
-
-    pub(crate) fn set_global(entity: Entity<Self>, cx: &mut App) {
-        cx.set_global(GlobalProfileStore(entity));
-    }
-
-    pub(crate) fn new(cx: &mut Context<Self>) -> Self {
-        let backend = Backend::global(cx);
-
-        let subscription = cx.subscribe(&backend, |this, _backend, event, cx| match event {
-            BackendEvent::NostrUpdate(update) if update.kind == Kind::Metadata => {
-                this.apply_author(update.author, cx);
-            }
-            BackendEvent::Published(event) if event.kind == Kind::Metadata => {
-                let metadata = Metadata::from_json(&event.content).unwrap_or_default();
-                this.profiles
-                    .insert(event.pubkey, Profile::new(event.pubkey, metadata));
-                cx.notify();
-            }
-            _ => {}
-        });
-
-        // Fetch requests are queued on a channel and synced in batches by a
-        // background task.
-        let client = backend.read(cx).client();
-        let (sender, receiver) = flume::unbounded::<PublicKey>();
-        let (dispatch_tx, dispatch_rx) = flume::unbounded::<Dispatch>();
-
-        let mut tasks = Vec::new();
-
-        tasks.push(cx.background_spawn(async move {
-            Self::handle_requests(&client, &dispatch_tx, &receiver).await
-        }));
-
-        // Re-read seen profiles from the database after each batch sync.
-        tasks.push(cx.spawn(async move |this, cx| {
-            while let Ok(Dispatch::Synced) = dispatch_rx.recv_async().await {
-                this.update(cx, |this, cx| this.apply_seen(cx)).ok();
-            }
-            Ok(())
-        }));
-
-        let mut store = Self {
-            profiles: HashMap::new(),
-            seen: RefCell::new(HashSet::new()),
-            sender,
-            tasks,
-            _subscription: subscription,
-        };
-
-        store.load(cx);
-        store
-    }
-
-    /// Get a profile. Returns a placeholder (default metadata) and queues a
-    /// fetch if the profile isn't cached yet.
-    pub fn get(&self, public_key: &PublicKey) -> Profile {
-        if let Some(profile) = self.profiles.get(public_key) {
-            return profile.clone();
-        }
-
-        let public_key = *public_key;
-
-        if self.seen.borrow_mut().insert(public_key)
-            && let Err(e) = self.sender.send(public_key)
-        {
-            log::warn!("failed to queue profile fetch: {e}");
-        }
-
-        Profile::new(public_key, Metadata::default())
-    }
-
-    /// Load recently seen profiles from the local database.
-    fn load(&mut self, cx: &mut Context<Self>) {
-        let client = Backend::global(cx).read(cx).client();
-
-        let work = cx.background_spawn(async move {
-            let filter = Filter::new().kind(Kind::Metadata).limit(200);
-            let events = client.database().query(filter).await?;
-
-            // Parse off the main thread; only plain profiles cross back.
-            let profiles: Vec<Profile> = events
-                .into_iter()
-                .map(|event| {
-                    let metadata = Metadata::from_json(&event.content).unwrap_or_default();
-                    Profile::new(event.pubkey, metadata)
-                })
-                .collect();
-
-            Ok::<_, Error>(profiles)
-        });
-
-        self.tasks.push(cx.spawn(async move |this, cx| {
-            let profiles = work.await?;
-
-            this.update(cx, |this, cx| {
-                for profile in profiles {
-                    this.profiles.insert(profile.public_key(), profile);
-                }
-                cx.notify();
-            })?;
-
-            Ok(())
-        }));
-    }
-
-    /// Re-read the latest metadata of an author from the local database.
-    fn apply_author(&mut self, public_key: PublicKey, cx: &mut Context<Self>) {
-        let client = Backend::global(cx).read(cx).client();
-
-        let work = cx.background_spawn(async move {
-            let filter = Filter::new().kind(Kind::Metadata).author(public_key);
-            let events = client.database().query(filter).await?;
-
-            // Parse off the main thread; only the profile crosses back.
-            let profile = events
-                .into_iter()
-                .max_by_key(|e| e.created_at)
-                .map(|event| {
-                    let metadata = Metadata::from_json(event.content).unwrap_or_default();
-                    Profile::new(event.pubkey, metadata)
-                });
-
-            Ok::<_, Error>(profile)
-        });
-
-        self.tasks.push(cx.spawn(async move |this, cx| {
-            let profile = work.await?;
-
-            this.update(cx, |this, cx| {
-                if let Some(profile) = profile {
-                    this.profiles.insert(profile.public_key(), profile);
-                    cx.notify();
-                }
-            })?;
-
-            Ok(())
-        }));
-    }
-
-    /// Re-read the latest metadata of every requested author from the local
-    /// database (used after a sync, which produces no NostrUpdate events).
-    fn apply_seen(&mut self, cx: &mut Context<Self>) {
-        let authors: Vec<PublicKey> = self.seen.borrow().iter().copied().collect();
-
-        if authors.is_empty() {
-            return;
-        }
-
-        let client = Backend::global(cx).read(cx).client();
-
-        let work = cx.background_spawn(async move {
-            let filter = Filter::new().kind(Kind::Metadata).authors(authors);
-            let events = client.database().query(filter).await?;
-
-            // Pick the latest metadata per author off the main thread.
-            let mut latest: HashMap<PublicKey, (Timestamp, Metadata)> = HashMap::new();
-            for event in events {
-                match latest.get(&event.pubkey) {
-                    Some((ts, _)) if *ts >= event.created_at => {}
-                    _ => {
-                        latest.insert(
-                            event.pubkey,
-                            (
-                                event.created_at,
-                                Metadata::from_json(&event.content).unwrap_or_default(),
-                            ),
-                        );
-                    }
-                }
-            }
-
-            let profiles: Vec<Profile> = latest
-                .into_iter()
-                .map(|(public_key, (_, metadata))| Profile::new(public_key, metadata))
-                .collect();
-
-            Ok::<_, Error>(profiles)
-        });
-
-        self.tasks.push(cx.spawn(async move |this, cx| {
-            let profiles = work.await?;
-
-            this.update(cx, |this, cx| {
-                for profile in profiles {
-                    this.profiles.insert(profile.public_key(), profile);
-                }
-                cx.notify();
-            })?;
-
-            Ok(())
-        }));
-    }
-
-    /// Sync metadata for requested authors in batches, debounced to collect
-    /// requests. Runs on a background thread; results are dispatched to the
-    /// main thread, which re-reads the database.
-    async fn handle_requests(
-        client: &Client,
-        dispatch: &Sender<Dispatch>,
-        receiver: &Receiver<PublicKey>,
-    ) -> Result<(), Error> {
-        let mut batch: HashSet<PublicKey> = HashSet::new();
-
-        loop {
-            // Wait for the first request of a batch.
-            match receiver.recv_timeout(BATCH_TIMEOUT) {
-                Ok(public_key) => {
-                    batch.insert(public_key);
-                }
-                Err(RecvTimeoutError::Disconnected) => return Ok(()),
-                Err(RecvTimeoutError::Timeout) => continue,
-            };
-
-            // Collect everything that arrives within the debounce window.
-            let deadline = Instant::now() + BATCH_TIMEOUT;
-            while let Ok(public_key) = receiver.recv_deadline(deadline) {
-                batch.insert(public_key);
-            }
-
-            let filter = Filter::new()
-                .kind(Kind::Metadata)
-                .authors(batch.drain().collect::<Vec<PublicKey>>());
-
-            // Negentropy-sync with the bootstrap relays. Synced events are
-            // written to the database directly (no NostrUpdate), so re-apply
-            // from the database afterwards.
-            match sync_bootstrap_only(client, filter, SyncOptions::default()).await {
-                Ok(_) => {
-                    if dispatch.send(Dispatch::Synced).is_err() {
-                        log::warn!("profile dispatch channel closed, dropping sync result");
-                    }
-                }
-                Err(e) => log::warn!("profile sync failed: {e}"),
-            }
-        }
-    }
-}

crates/signed_state/src/push.rs

@@ -0,0 +1,114 @@
+use nostr::prelude::Url;
+use nostr_sdk::prelude::*;
+
+/// `ws://` grasp servers, like ngit, use `http(s)://<host>`.
+pub(crate) fn grasp_base_url(relay: &RelayUrl) -> Option<String> {
+    let parsed = Url::parse(relay.as_str()).ok()?;
+    let host = parsed.host_str()?;
+    let port = parsed
+        .port()
+        .map(|port| format!(":{port}"))
+        .unwrap_or_default();
+    let scheme = if relay.scheme().is_secure() {
+        "https"
+    } else {
+        "http"
+    };
+    Some(format!("{scheme}://{host}{port}"))
+}
+
+pub(crate) fn grasp_clone_url(relay: &RelayUrl, owner: &str, repo_id: &str) -> Option<Url> {
+    let base = grasp_base_url(relay)?;
+    Url::parse(&format!("{base}/{owner}/{repo_id}.git")).ok()
+}
+
+/// GRASP-06 contributor namespace URL of a pull request tip.
+pub(crate) fn grasp06_prs_url(base_url: &str, npub: &str, repo_id: &str) -> String {
+    format!("{base_url}/prs/{npub}/{repo_id}.git")
+}
+
+/// The author's GRASP-06 `/prs/` URLs come first.
+pub(crate) fn pr_clone_urls(prs_urls: Vec<Url>, base_clone_urls: Vec<Url>) -> Vec<Url> {
+    let mut seen = std::collections::HashSet::new();
+    let mut urls = Vec::new();
+    for url in prs_urls.into_iter().chain(base_clone_urls) {
+        if seen.insert(url.to_string()) {
+            urls.push(url);
+        }
+    }
+    urls
+}
+
+#[derive(Debug, Clone)]
+pub struct GraspServer {
+    relay: RelayUrl,
+    reason: Option<String>,
+}
+
+impl GraspServer {
+    pub(crate) fn ok(relay: RelayUrl) -> Self {
+        Self {
+            relay,
+            reason: None,
+        }
+    }
+
+    pub(crate) fn failed(relay: &RelayUrl, reason: impl Into<String>) -> Self {
+        Self {
+            relay: relay.to_owned(),
+            reason: Some(reason.into()),
+        }
+    }
+
+    pub fn relay(&self) -> &RelayUrl {
+        &self.relay
+    }
+
+    pub fn reason(&self) -> Option<&str> {
+        self.reason.as_deref()
+    }
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct PushOutcome {
+    pub servers: Vec<GraspServer>,
+    /// The newest state event a grasp relay accepted for this push.
+    pub state_event: Option<Event>,
+}
+
+impl PushOutcome {
+    pub fn accepted(&self) -> usize {
+        self.servers
+            .iter()
+            .filter(|server| server.reason.is_none())
+            .count()
+    }
+
+    fn failing(&self) -> impl Iterator<Item = &GraspServer> {
+        self.servers.iter().filter(|server| server.reason.is_some())
+    }
+
+    pub fn failure_summary(&self) -> String {
+        self.failing()
+            .map(|server| {
+                let reason =
+                    utils::flatten_whitespace(server.reason.as_deref().unwrap_or("unknown error"));
+                format!("{}: {reason}", server.relay)
+            })
+            .collect::<Vec<_>>()
+            .join("; ")
+    }
+
+    /// `None` when every server accepted the push or nothing was pushed.
+    pub fn partial_warning(&self) -> Option<String> {
+        let accepted = self.accepted();
+        if self.servers.is_empty() || accepted == self.servers.len() {
+            return None;
+        }
+        Some(format!(
+            "Pushed to {accepted} of {} grasp servers: {}. Republish to sync.",
+            self.servers.len(),
+            self.failure_summary()
+        ))
+    }
+}

crates/signed_state/src/refresh.rs

@@ -0,0 +1,40 @@
+#[derive(Debug, Default)]
+pub struct RefreshGate {
+    running: bool,
+    dirty: bool,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RefreshRequest {
+    Schedule,
+    Fold,
+}
+
+impl RefreshGate {
+    pub fn running(&self) -> bool {
+        self.running
+    }
+
+    pub fn request(&mut self) -> RefreshRequest {
+        if self.running {
+            self.dirty = true;
+            RefreshRequest::Fold
+        } else {
+            RefreshRequest::Schedule
+        }
+    }
+
+    pub fn begin(&mut self) {
+        self.running = true;
+    }
+
+    pub fn finish(&mut self) -> bool {
+        self.running = false;
+        std::mem::take(&mut self.dirty)
+    }
+
+    // Pending follow-up requests survive an abandoned run.
+    pub fn abort(&mut self) {
+        self.running = false;
+    }
+}

crates/signed_state/src/repo_list.rs

@@ -1,353 +0,0 @@
-use std::collections::HashMap;
-use std::sync::Arc;
-use std::time::Duration;
-
-use anyhow::Error;
-use gpui::{App, AppContext, Context, Entity, Global, Subscription, Task};
-use nostr_sdk::prelude::*;
-use signed_core::{Announcement, Deletions, RepoAddr, filters, repo_addr};
-
-use crate::backend::{Backend, BackendEvent};
-
-/// Delay between a refresh request and the actual re-query, so bursts of
-/// events (e.g. sync progress ticks) collapse into one query.
-const REFRESH_DEBOUNCE: Duration = Duration::from_millis(300);
-
-/// How far back activity events count toward a repository's last activity.
-const ACTIVITY_WINDOW: Duration = Duration::from_secs(90 * 86_400);
-
-struct GlobalRepoListStore(Entity<RepoListStore>);
-
-impl Global for GlobalRepoListStore {}
-
-/// Counts of NIP-34 activity events per repository, used to rank the
-/// explore list by popularity. Each patch event is a pushed commit (or a
-/// small series), the closest proxy for commit count in the event data.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
-pub struct RepoActivityCounts {
-    /// Root `30611` issue events addressed to the repository.
-    pub issues: u32,
-    /// Root `3063` pull request events addressed to the repository
-    /// (updates to a PR are not new PRs and don't count).
-    pub pull_requests: u32,
-    /// `1617` patch events addressed to the repository.
-    pub commits: u32,
-}
-
-impl RepoActivityCounts {
-    /// Total issues + pull requests + commits; the popularity ranking key.
-    pub fn score(self) -> u32 {
-        self.issues + self.pull_requests + self.commits
-    }
-}
-
-/// Store listing repository announcements (global discovery or per-author).
-///
-/// The all-repos store (`author: None`) is created at startup by
-/// [`crate::init`] and installed as a global, so the explore panel renders
-/// what's in the local database without waiting for relays.
-pub struct RepoListStore {
-    /// Shared so views can clone the list per frame without a deep copy.
-    pub announcements: Arc<Vec<Announcement>>,
-    /// Latest known activity timestamp per repository
-    /// (announcements, state updates, patches, PRs, issues, statuses).
-    pub last_activity: Arc<HashMap<RepoAddr, Timestamp>>,
-    /// Issues + pull requests + commits per repository, for the Popular
-    /// ranking of the explore list.
-    pub counts: Arc<HashMap<RepoAddr, RepoActivityCounts>>,
-    author: Option<PublicKey>,
-    refreshing: bool,
-    refresh_dirty: bool,
-    /// A refresh is waiting out [`REFRESH_DEBOUNCE`].
-    debouncing: bool,
-    tasks: Vec<Task<Result<(), Error>>>,
-    _subscription: Subscription,
-}
-
-impl RepoListStore {
-    /// Retrieve the global explore store (all announcements, created at
-    /// startup by [`crate::init`]).
-    pub fn global(cx: &App) -> Entity<Self> {
-        cx.global::<GlobalRepoListStore>().0.clone()
-    }
-
-    pub(crate) fn set_global(entity: Entity<Self>, cx: &mut App) {
-        cx.set_global(GlobalRepoListStore(entity));
-    }
-
-    /// Create a store. If `author` is `None`, all announcements are listed.
-    pub fn new(author: Option<PublicKey>, cx: &mut Context<Self>) -> Self {
-        let backend = Backend::global(cx);
-
-        let subscription = cx.subscribe(&backend, |this, _backend, event, cx| {
-            let relevant = match event {
-                BackendEvent::NostrUpdate(update) => {
-                    // Deletions may target anything we list; always refresh.
-                    if update.kind == Kind::EventDeletion || update.kind == Kind::RequestToVanish {
-                        true
-                    } else if filters::ACTIVITY_KINDS.contains(&update.kind) {
-                        // Activity (patches, issues, ...) is addressed to repos via
-                        // `a` tags, so its author isn't the repo owner; always refresh.
-                        true
-                    } else {
-                        let is_announcement = update.kind == Kind::GitRepoAnnouncement;
-                        let is_repo_state = update.kind == Kind::RepoState;
-                        let tracked = is_announcement || is_repo_state;
-                        tracked && this.author.is_none_or(|a| a == update.author)
-                    }
-                }
-                BackendEvent::Published(event) => {
-                    let announcement = event.kind == Kind::GitRepoAnnouncement
-                        && this.author.is_none_or(|a| a == event.pubkey);
-                    // Locally published deletions (e.g. deleting a repo)
-                    // are already in the local database; refresh so they
-                    // take effect immediately, like relay deletions.
-                    let deletion =
-                        event.kind == Kind::EventDeletion || event.kind == Kind::RequestToVanish;
-                    announcement || deletion
-                }
-                BackendEvent::Synced | BackendEvent::SyncProgress { .. } => true,
-                _ => false,
-            };
-
-            if relevant {
-                this.refresh(cx);
-            }
-        });
-
-        let mut store = Self {
-            announcements: Arc::new(Vec::new()),
-            last_activity: Arc::new(HashMap::new()),
-            counts: Arc::new(HashMap::new()),
-            author,
-            refreshing: false,
-            refresh_dirty: false,
-            debouncing: false,
-            _subscription: subscription,
-            tasks: Vec::new(),
-        };
-
-        store.subscribe_remote(cx);
-        // Query the local database right away; the list never waits for the
-        // relay syncs started above to finish.
-        store.refresh_initial(cx);
-        store
-    }
-
-    /// Scope the list to an author (or clear the scope with `None`).
-    pub fn set_author(&mut self, author: Option<PublicKey>, cx: &mut Context<Self>) {
-        self.author = author;
-        self.subscribe_remote(cx);
-        self.refresh(cx);
-    }
-
-    /// Negentropy-sync announcements with the bootstrap relays.
-    fn subscribe_remote(&mut self, cx: &mut Context<Self>) {
-        let backend = Backend::global(cx);
-        let author = self.author;
-
-        backend.update(cx, |backend, cx| {
-            let filter = match author {
-                Some(a) => filters::announcements_by(a),
-                None => filters::all_announcements(),
-            };
-            backend.sync_bootstrap(filter, cx);
-            // Deletion requests (NIP-09/62) must be known before any
-            // announcement can be shown.
-            backend.sync_bootstrap(filters::deletions(), cx);
-        });
-    }
-
-    /// One-shot initial load: query the local database immediately (no
-    /// debounce), so stored announcements appear as soon as the app opens.
-    /// Only called from [`Self::new`], before any refresh can be pending.
-    fn refresh_initial(&mut self, cx: &mut Context<Self>) {
-        debug_assert!(!self.debouncing);
-        if self.refreshing {
-            self.refresh_dirty = true;
-            return;
-        }
-        self.run_refresh(cx);
-    }
-
-    /// Re-query the local database. Latest announcement per repository wins.
-    ///
-    /// Debounced: a short delay collapses bursts of requests (e.g. sync
-    /// progress ticks), and requests that arrive while a query is running
-    /// are folded into one follow-up query. The query and processing run on
-    /// a background thread; only the results are applied on the main thread.
-    pub fn refresh(&mut self, cx: &mut Context<Self>) {
-        if self.refreshing {
-            self.refresh_dirty = true;
-            return;
-        }
-        if self.debouncing {
-            return;
-        }
-        self.debouncing = true;
-
-        let task = cx.spawn(async move |this, cx| {
-            cx.background_executor().timer(REFRESH_DEBOUNCE).await;
-
-            this.update(cx, |this, cx| {
-                this.debouncing = false;
-                this.run_refresh(cx);
-            })
-        });
-
-        self.tasks.push(task);
-    }
-
-    /// One query + apply cycle (debounced entry point).
-    fn run_refresh(&mut self, cx: &mut Context<Self>) {
-        self.refreshing = true;
-
-        let client = Backend::global(cx).read(cx).client();
-        let author = self.author;
-
-        let work = cx.background_spawn(async move {
-            let filter = match author {
-                Some(a) => filters::announcements_by(a),
-                None => filters::all_announcements(),
-            };
-
-            let events = client.database().query(filter).await?;
-            let deletion_events = client.database().query(filters::deletions()).await?;
-            let deletions = Deletions::from_events(deletion_events);
-
-            // Dedup and sort off the main thread; only the final list
-            // crosses back into the entity.
-            let mut by_repo: HashMap<RepoAddr, Announcement> = HashMap::new();
-
-            for event in events {
-                if deletions.is_deleted(&event) {
-                    continue;
-                }
-
-                let Some(announcement) = Announcement::from_event(&event) else {
-                    continue;
-                };
-
-                let addr = announcement.addr();
-
-                match by_repo.get(&addr) {
-                    Some(existing) if existing.created_at >= announcement.created_at => {}
-                    _ => {
-                        by_repo.insert(addr, announcement);
-                    }
-                }
-            }
-
-            let mut announcements: Vec<Announcement> = by_repo.into_values().collect();
-            announcements.sort_by_key(|a| std::cmp::Reverse(a.created_at));
-
-            // Last activity per repository: state updates plus all NIP-34
-            // activity events (patches, PRs, issues, statuses).
-            let mut last_activity: HashMap<RepoAddr, Timestamp> = announcements
-                .iter()
-                .map(|a| (a.addr(), a.created_at))
-                .collect();
-
-            let state_filter = Filter::new().kind(Kind::RepoState);
-            for event in client.database().query(state_filter).await? {
-                if deletions.is_deleted(&event) {
-                    continue;
-                }
-                let Some(id) = event.tags.identifier() else {
-                    continue;
-                };
-                let addr = repo_addr(event.pubkey, id);
-                let Some(entry) = last_activity.get_mut(&addr) else {
-                    continue;
-                };
-                *entry = (*entry).max(event.created_at);
-            }
-
-            // Bound the activity query to a recent window; older repos fall
-            // back to their announcement / state timestamps.
-            let activity_filter = Filter::new()
-                .kinds(filters::ACTIVITY_KINDS)
-                .since(Timestamp::now() - ACTIVITY_WINDOW);
-            for event in client.database().query(activity_filter).await? {
-                if deletions.is_deleted(&event) {
-                    continue;
-                }
-                for addr in event.tags.coordinates() {
-                    if addr.kind != Kind::GitRepoAnnouncement {
-                        continue;
-                    }
-                    // Skip events for repos we don't list, so the map can't
-                    // grow beyond the number of announcements.
-                    let Some(entry) = last_activity.get_mut(&addr) else {
-                        continue;
-                    };
-                    *entry = (*entry).max(event.created_at);
-                }
-            }
-
-            // Popularity counts per repository (issues, pull requests and
-            // patches). Unbounded, unlike the windowed activity query
-            // above, so totals are exact.
-            let mut counts: HashMap<RepoAddr, RepoActivityCounts> = HashMap::new();
-            let count_filter =
-                Filter::new().kinds([Kind::GitIssue, Kind::GitPullRequest, Kind::GitPatch]);
-            for event in client.database().query(count_filter).await? {
-                if deletions.is_deleted(&event) {
-                    continue;
-                }
-                for addr in event.tags.coordinates() {
-                    // Skip events for repos we don't list, so the map can't
-                    // grow beyond the number of announcements.
-                    if addr.kind != Kind::GitRepoAnnouncement || !last_activity.contains_key(&addr)
-                    {
-                        continue;
-                    }
-                    let entry = counts.entry(addr).or_default();
-                    match event.kind {
-                        Kind::GitIssue => entry.issues += 1,
-                        Kind::GitPullRequest => entry.pull_requests += 1,
-                        Kind::GitPatch => entry.commits += 1,
-                        _ => {}
-                    }
-                }
-            }
-
-            Ok::<_, Error>((announcements, last_activity, counts))
-        });
-
-        self.tasks.push(cx.spawn(async move |this, cx| {
-            let (announcements, last_activity, counts) = match work.await {
-                Ok(results) => results,
-                // Database errors are transient; keep the last list.
-                Err(_) => {
-                    return this.update(cx, |this, _cx| {
-                        this.refreshing = false;
-                    });
-                }
-            };
-
-            let again = this.update(cx, |this, cx| {
-                this.announcements = Arc::new(announcements);
-                this.last_activity = Arc::new(last_activity);
-                this.counts = Arc::new(counts);
-                cx.notify();
-
-                this.refreshing = false;
-                if this.refresh_dirty {
-                    this.refresh_dirty = false;
-                    true
-                } else {
-                    false
-                }
-            })?;
-
-            // Requests that arrived while the refresh was running are
-            // coalesced into one follow-up refresh.
-            if again {
-                this.update(cx, |this, cx| this.refresh(cx))?;
-            }
-
-            Ok(())
-        }));
-    }
-}

crates/signed_state/src/repos.rs

@@ -0,0 +1,283 @@
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+use std::time::Duration;
+
+use anyhow::Error;
+use gpui::{App, AppContext, Context, Entity, Global, Subscription};
+use nostr_sdk::prelude::*;
+use signed_core::{Announcement, Deletions, Filters, RepoAddr, filters};
+
+use crate::backend::{Backend, BackendEvent};
+use crate::refresh::{RefreshGate, RefreshRequest};
+
+/// How far back activity events count toward a repository's last activity.
+const ACTIVITY_WINDOW: Duration = Duration::from_secs(90 * 86_400);
+
+struct GlobalRepoListStore(Entity<RepoListStore>);
+
+impl Global for GlobalRepoListStore {}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct RepoActivityCounts {
+    pub issues: u32,
+    pub pull_requests: u32,
+    pub commits: u32,
+}
+
+impl RepoActivityCounts {
+    pub fn score(self) -> u32 {
+        self.issues + self.pull_requests + self.commits
+    }
+}
+
+pub struct RepoListStore {
+    pub announcements: Arc<Vec<Announcement>>,
+    pub last_activity: Arc<HashMap<RepoAddr, Timestamp>>,
+    pub counts: Arc<HashMap<RepoAddr, RepoActivityCounts>>,
+    state_synced_repos: HashSet<RepoAddr>,
+    refresh: RefreshGate,
+    _subscription: Subscription,
+}
+
+impl RepoListStore {
+    pub fn global(cx: &App) -> Entity<Self> {
+        cx.global::<GlobalRepoListStore>().0.clone()
+    }
+
+    pub(crate) fn set_global(entity: Entity<Self>, cx: &mut App) {
+        cx.set_global(GlobalRepoListStore(entity));
+    }
+
+    pub fn new(cx: &mut Context<Self>) -> Self {
+        let backend = Backend::global(cx);
+        let weak = cx.entity().downgrade();
+
+        let subscription = cx.subscribe(&backend, |this, _backend, event, cx| {
+            let relevant = match event {
+                BackendEvent::SignerChanged => {
+                    this.state_synced_repos.clear();
+                    true
+                }
+                BackendEvent::RepoUpdates(_) => true,
+                BackendEvent::Synced => true,
+                _ => false,
+            };
+
+            if relevant {
+                this.refresh(cx);
+            }
+        });
+
+        cx.defer(move |cx| {
+            weak.update(cx, |this, cx| {
+                this.subscribe_remote(cx);
+                this.refresh(cx);
+            })
+            .ok();
+        });
+
+        Self {
+            announcements: Arc::new(Vec::new()),
+            last_activity: Arc::new(HashMap::new()),
+            counts: Arc::new(HashMap::new()),
+            state_synced_repos: HashSet::new(),
+            refresh: RefreshGate::default(),
+            _subscription: subscription,
+        }
+    }
+
+    pub fn announcements_of(&self, user: &PublicKey) -> Vec<Announcement> {
+        self.announcements
+            .iter()
+            .filter(|a| a.owner == *user)
+            .cloned()
+            .collect()
+    }
+
+    fn subscribe_remote(&mut self, cx: &mut Context<Self>) {
+        let backend = Backend::global(cx);
+
+        backend.update(cx, |backend, cx| {
+            backend.sync_bootstraps(
+                vec![
+                    Filters::all_announcements(),
+                    Filters::all_states(),
+                    // Deletion requests, NIP-09/62, must be known before any announcement is shown.
+                    Filters::deletions(),
+                ],
+                cx,
+            );
+        });
+    }
+
+    fn sync_own_repo_states(&mut self, cx: &mut Context<Self>) {
+        let backend = Backend::global(cx);
+        let Some(me) = backend.read(cx).current_user() else {
+            return;
+        };
+
+        let pending: Vec<(RepoAddr, Vec<RelayUrl>)> = self
+            .announcements
+            .iter()
+            .filter(|announcement| announcement.owner == me && !announcement.relays.is_empty())
+            .map(|announcement| (announcement.addr(), announcement.relays.clone()))
+            .filter(|(addr, _)| !self.state_synced_repos.contains(addr))
+            .collect();
+
+        for (addr, relays) in pending {
+            self.state_synced_repos.insert(addr.clone());
+
+            backend.update(cx, |backend, cx| {
+                backend.connect_repo_relays(relays, vec![addr.state_filter()], cx);
+            });
+        }
+    }
+
+    // Runs immediately: the backend pump already batches the relay events
+    // that trigger a refresh, so no per-store debounce is needed.
+    pub fn refresh(&mut self, cx: &mut Context<Self>) {
+        if self.refresh.request() != RefreshRequest::Schedule {
+            return;
+        }
+
+        self.run_refresh(cx);
+    }
+
+    fn run_refresh(&mut self, cx: &mut Context<Self>) {
+        self.refresh.begin();
+
+        let backend = Backend::global(cx);
+        let client = backend.read(cx).client();
+
+        let work = cx.background_spawn(async move {
+            let filter = Filters::all_announcements();
+            let events = client.database().query(filter).await?;
+
+            let deletion_events = client.database().query(Filters::deletions()).await?;
+            let deletions = Deletions::from_events(deletion_events);
+
+            // Dedup and sort off the main thread; only the final list crosses
+            // back into the entity.
+            let mut by_repo: HashMap<RepoAddr, Announcement> = HashMap::new();
+
+            for event in events {
+                if deletions.is_deleted(&event) {
+                    continue;
+                }
+
+                let Some(announcement) = Announcement::from_event(&event) else {
+                    continue;
+                };
+
+                let addr = announcement.addr();
+
+                match by_repo.get(&addr) {
+                    Some(existing) if existing.created_at >= announcement.created_at => {}
+                    _ => {
+                        by_repo.insert(addr, announcement);
+                    }
+                }
+            }
+
+            let mut announcements: Vec<Announcement> = by_repo.into_values().collect();
+            announcements.sort_by_key(|a| std::cmp::Reverse(a.created_at));
+
+            let mut last_activity: HashMap<RepoAddr, Timestamp> = announcements
+                .iter()
+                .map(|a| (a.addr(), a.created_at))
+                .collect();
+
+            let state_filter = Filter::new().kind(Kind::RepoState);
+            for event in client.database().query(state_filter).await? {
+                if deletions.is_deleted(&event) {
+                    continue;
+                }
+                let Some(id) = event.tags.identifier() else {
+                    continue;
+                };
+                let addr = RepoAddr::new(event.pubkey, id);
+                let Some(entry) = last_activity.get_mut(&addr) else {
+                    continue;
+                };
+                *entry = (*entry).max(event.created_at);
+            }
+
+            // Older repos fall back to their announcement or state timestamps.
+            let activity_filter = Filter::new()
+                .kinds(filters::ACTIVITY_KINDS)
+                .since(Timestamp::now() - ACTIVITY_WINDOW);
+
+            for event in client.database().query(activity_filter).await? {
+                if deletions.is_deleted(&event) {
+                    continue;
+                }
+                for coordinate in event.tags.coordinates() {
+                    if coordinate.kind != Kind::GitRepoAnnouncement {
+                        continue;
+                    }
+                    let addr = RepoAddr::from(coordinate.clone());
+                    let Some(entry) = last_activity.get_mut(&addr) else {
+                        continue;
+                    };
+                    *entry = (*entry).max(event.created_at);
+                }
+            }
+
+            // Unbounded, unlike the windowed activity query above, so totals
+            // are exact.
+            let mut counts: HashMap<RepoAddr, RepoActivityCounts> = HashMap::new();
+            let count_filter =
+                Filter::new().kinds([Kind::GitIssue, Kind::GitPullRequest, Kind::GitPatch]);
+
+            for event in client.database().query(count_filter).await? {
+                if deletions.is_deleted(&event) {
+                    continue;
+                }
+                for coordinate in event.tags.coordinates() {
+                    if coordinate.kind != Kind::GitRepoAnnouncement
+                        || !last_activity.contains_key(&RepoAddr::from(coordinate.clone()))
+                    {
+                        continue;
+                    }
+                    let entry = counts.entry(RepoAddr::from(coordinate)).or_default();
+                    match event.kind {
+                        Kind::GitIssue => entry.issues += 1,
+                        Kind::GitPullRequest => entry.pull_requests += 1,
+                        Kind::GitPatch => entry.commits += 1,
+                        _ => {}
+                    }
+                }
+            }
+
+            Ok::<_, Error>((announcements, last_activity, counts))
+        });
+
+        cx.spawn(async move |this, cx| {
+            let (announcements, last_activity, counts) = match work.await {
+                Ok(results) => results,
+                Err(_) => {
+                    return this.update(cx, |this, _cx| {
+                        this.refresh.abort();
+                    });
+                }
+            };
+
+            let again = this.update(cx, |this, cx| {
+                this.announcements = Arc::new(announcements);
+                this.last_activity = Arc::new(last_activity);
+                this.counts = Arc::new(counts);
+                this.sync_own_repo_states(cx);
+                cx.notify();
+
+                this.refresh.finish()
+            })?;
+
+            if again {
+                this.update(cx, |this, cx| this.refresh(cx))?;
+            }
+
+            Ok(())
+        })
+        .detach();
+    }
+}

crates/signed_state/src/state.rs

@@ -0,0 +1,534 @@
+use std::path::{Path, PathBuf};
+use std::str::FromStr;
+
+use anyhow::{Error, anyhow, bail};
+use bitcoin_hashes::sha1::Hash as Sha1Hash;
+use gpui::{AppContext, AsyncApp};
+use nostr::prelude::*;
+use nostr_sdk::prelude::*;
+use signed_core::Announcement;
+use signed_git::Repo;
+
+use crate::push::{GraspServer, PushOutcome, grasp_base_url};
+
+/// A git ref with the commit it points at.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GitRef {
+    /// Full ref name, like `refs/heads/main` or `refs/tags/v1.0`.
+    pub name: String,
+    pub commit: Sha1Hash,
+}
+
+impl GitRef {
+    pub fn new(name: impl Into<String>, commit: &str) -> Result<Self, Error> {
+        let commit = Sha1Hash::from_str(commit).map_err(|_| anyhow!("invalid commit: {commit}"))?;
+
+        Ok(Self {
+            name: name.into(),
+            commit,
+        })
+    }
+}
+
+/// How much to push to the grasp servers.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum GitPushMode {
+    /// Mirror all branches and tags.
+    #[default]
+    All,
+    /// Push `refs/heads/main` only (repo creation).
+    Main,
+}
+
+/// How to handle server-only refs when pushing.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum GitPushPolicy {
+    /// Reconcile the local refs with the grasp servers,
+    /// fetching missing refs before pushing.
+    #[default]
+    Reconcile,
+    /// Declare the local refs only and delete server-only refs while pushing.
+    ResetRemote,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SyncState {
+    pub refs: Vec<GitRef>,
+    pub head: Option<String>,
+    /// Local repository to push from; `None` for states parsed from events.
+    pub path: Option<PathBuf>,
+    pub mode: GitPushMode,
+    pub policy: GitPushPolicy,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PushStep {
+    AnnounceRepository,
+    /// Publish the state event to one grasp server.
+    StageStateEvent(RelayUrl),
+    /// Git push to one grasp server.
+    PushObjects(RelayUrl),
+    /// Fan the state event out to the relays.
+    BroadcastStateEvent,
+}
+
+#[derive(Debug, Clone)]
+pub enum PushStepStatus {
+    Running(PushStep),
+    Done(PushStep),
+    Failed(PushStep, String),
+}
+
+impl PushStep {
+    pub fn label(&self) -> String {
+        match self {
+            Self::AnnounceRepository => "Announce repository".to_owned(),
+            Self::StageStateEvent(relay) => format!("Publish state event -> {relay}"),
+            Self::BroadcastStateEvent => "Publish state event to relays".to_owned(),
+            Self::PushObjects(relay) => format!(
+                "Push objects -> {}",
+                grasp_base_url(relay).unwrap_or_else(|| relay.to_string())
+            ),
+        }
+    }
+}
+
+impl PushStepStatus {
+    pub fn step(&self) -> &PushStep {
+        match self {
+            Self::Running(step) | Self::Done(step) | Self::Failed(step, _) => step,
+        }
+    }
+}
+
+impl SyncState {
+    pub fn build(id: &str, refs: &[GitRef], head: Option<&str>) -> EventBuilder {
+        let mut tags: Vec<Tag> = vec![Tag::identifier(id.to_owned())];
+
+        for git_ref in refs {
+            let commit = git_ref.commit.to_string();
+            tags.push(Tag::parse([git_ref.name.as_str(), commit.as_str()]).expect("valid ref tag"));
+        }
+
+        if let Some(head) = head {
+            tags.push(
+                Tag::parse(["HEAD", &format!("ref: refs/heads/{head}")]).expect("valid HEAD tag"),
+            );
+        }
+
+        EventBuilder::new(Kind::RepoState, "").tags(tags)
+    }
+
+    pub fn parse(event: &Event) -> Self {
+        let mut refs = Vec::new();
+        let mut head = None;
+
+        for tag in event.tags.iter() {
+            match Nip34Tag::parse(tag.as_slice()) {
+                Ok(Nip34Tag::Head(branch)) => head = Some(branch),
+                Ok(Nip34Tag::RefHead { branch, commit }) => {
+                    refs.push(GitRef {
+                        name: format!("refs/heads/{branch}"),
+                        commit,
+                    });
+                }
+                Ok(Nip34Tag::RefTag { name, commit }) => {
+                    refs.push(GitRef {
+                        name: format!("refs/tags/{name}"),
+                        commit,
+                    });
+                }
+                _ => {}
+            }
+        }
+
+        Self {
+            refs,
+            head,
+            path: None,
+            mode: GitPushMode::default(),
+            policy: GitPushPolicy::default(),
+        }
+    }
+
+    /// Reads the refs and head of a local repository, ready to push.
+    pub fn from_repo(path: &Path) -> Result<Self, Error> {
+        let repo = Repo::open(path)?;
+        let state = repo.ref_state()?;
+
+        let refs = state
+            .refs
+            .iter()
+            .map(|(name, commit)| GitRef::new(name, commit))
+            .collect::<Result<Vec<_>, Error>>()?;
+
+        Ok(Self {
+            refs,
+            head: state.head,
+            path: Some(path.to_path_buf()),
+            mode: GitPushMode::default(),
+            policy: GitPushPolicy::default(),
+        })
+    }
+
+    pub fn with_mode(mut self, mode: GitPushMode) -> Self {
+        self.mode = mode;
+        self
+    }
+
+    pub fn with_policy(mut self, policy: GitPushPolicy) -> Self {
+        self.policy = policy;
+        self
+    }
+
+    /// Reconciles the local repository with the grasp servers, fetching missing refs.
+    pub async fn reconcile(
+        &mut self,
+        announcement: &Announcement,
+        cx: &mut AsyncApp,
+    ) -> Result<(), Error> {
+        if self.policy == GitPushPolicy::ResetRemote || self.refs.is_empty() {
+            return Ok(());
+        }
+
+        let Some(path) = self.path.clone() else {
+            return Ok(());
+        };
+
+        let local: Vec<(String, String)> = self
+            .refs
+            .iter()
+            .map(|git_ref| (git_ref.name.clone(), git_ref.commit.to_string()))
+            .collect();
+
+        let urls: Vec<String> = announcement
+            .clone
+            .iter()
+            .map(|url| url.to_string())
+            .collect();
+
+        let snapshot_path = path.clone();
+
+        let missing = cx
+            .background_spawn(async move {
+                let repo = Repo::open(&path)?;
+
+                // Refs the servers advertise that the local repository lacks
+                let mut missing: Vec<(String, Vec<String>)> = Vec::new();
+                // Diverged server tips that exist only on the servers
+                let mut backups: Vec<(String, String, Vec<String>)> = Vec::new();
+
+                for url in &urls {
+                    let Ok(remote_refs) = repo.ls_remote(url) else {
+                        continue;
+                    };
+
+                    for (name, oid) in remote_refs {
+                        let Some((_, local_oid)) =
+                            local.iter().find(|(local_name, _)| local_name == &name)
+                        else {
+                            match missing.iter_mut().find(|(known, _)| known == &name) {
+                                Some((_, sources)) => sources.push(url.clone()),
+                                None => missing.push((name, vec![url.clone()])),
+                            }
+                            continue;
+                        };
+
+                        if local_oid == &oid {
+                            continue;
+                        }
+
+                        if repo.merge_base(local_oid, &oid).is_err() {
+                            match backups.iter_mut().find(|(known, _, _)| known == &name) {
+                                Some((_, _, sources)) => sources.push(url.clone()),
+                                None => {
+                                    backups.push((name.clone(), oid.clone(), vec![url.clone()]))
+                                }
+                            }
+                        }
+                    }
+                }
+
+                let mut failures = Vec::new();
+
+                for (name, sources) in &missing {
+                    let refspec = format!("+{name}:{name}");
+                    if let Err(error) = repo.fetch_refs(sources, &refspec) {
+                        log::warn!("failed to fetch {name} from grasp servers: {error}");
+                        failures.push(name.clone());
+                    }
+                }
+
+                for (name, oid, sources) in &backups {
+                    let refspec = format!("+{name}:refs/nostr/backup/{oid}");
+                    if let Err(error) = repo.fetch_refs(sources, &refspec) {
+                        log::warn!("failed to back up {name} from grasp servers: {error}");
+                    }
+                }
+
+                match failures.is_empty() {
+                    true => Ok(missing
+                        .into_iter()
+                        .map(|(name, _)| name)
+                        .collect::<Vec<_>>()),
+                    false => bail!(
+                        "could not fetch {} from any grasp server",
+                        failures.join(", ")
+                    ),
+                }
+            })
+            .await?;
+
+        if !missing.is_empty() {
+            let (mode, policy) = (self.mode, self.policy);
+            *self = Self::from_repo(&snapshot_path)?;
+            self.mode = mode;
+            self.policy = policy;
+        }
+
+        Ok(())
+    }
+
+    /// State event for these refs; the caller signs it.
+    pub fn state_event(&self, repo_id: &str) -> EventBuilder {
+        Self::build(repo_id, &self.refs, self.head.as_deref())
+    }
+
+    /// Push the state event and objects to the grasp servers.
+    ///
+    /// Calling `on_step` for each step.
+    pub async fn push_to_grasps<P>(
+        &self,
+        client: &Client,
+        event: Event,
+        announcement: &Announcement,
+        cx: &mut AsyncApp,
+        on_step: &mut P,
+    ) -> Result<PushOutcome, Error>
+    where
+        P: FnMut(PushStepStatus, &mut AsyncApp) -> Result<(), Error>,
+    {
+        let path = self
+            .path
+            .as_deref()
+            .ok_or_else(|| anyhow!("push requires a local repository"))?;
+
+        let owner = announcement
+            .owner
+            .to_bech32()
+            .map_err(|error| anyhow!("could not encode the repository owner: {error}"))?;
+
+        let mut outcome = PushOutcome::default();
+        let policy = self.policy;
+        let declared: Vec<String> = self
+            .refs
+            .iter()
+            .map(|git_ref| git_ref.name.clone())
+            .collect();
+
+        for relay in &announcement.relays {
+            let step = PushStep::StageStateEvent(relay.clone());
+
+            // The relay must accept the state event before the git push is allowed.
+            on_step(PushStepStatus::Running(step.clone()), cx)?;
+
+            // Get base URL for the git push
+            let base = grasp_base_url(relay).unwrap_or_default();
+
+            // Ensure the relay is connected before sending the event.
+            client.add_relay(relay).and_connect().await?;
+
+            let staging = client.send_event(&event).to([relay.clone()]).await;
+            // Whether the relay accepted the event
+            let sent_failed = !staging
+                .as_ref()
+                .is_ok_and(|output| output.success.contains_key(relay));
+
+            if sent_failed {
+                let reason = match &staging {
+                    Ok(output) => output
+                        .failed
+                        .get(relay)
+                        .cloned()
+                        .unwrap_or_else(|| "relay did not confirm the event".to_owned()),
+                    Err(e) => format!("could not send the state event to {relay}: {e}"),
+                };
+
+                // Run the callback to report the failure
+                on_step(PushStepStatus::Failed(step, reason.clone()), cx)?;
+
+                // Record the failure in the outcome and continue to the next relay
+                outcome.servers.push(GraspServer::failed(relay, reason));
+                continue;
+            }
+
+            // Run the callback to report the success
+            on_step(PushStepStatus::Done(step), cx)?;
+
+            // Run the git push in the background, reporting progress through the callback
+            let step = PushStep::PushObjects(relay.clone());
+            on_step(PushStepStatus::Running(step.clone()), cx)?;
+
+            let pushed = cx.background_spawn({
+                let path = path.to_path_buf();
+                let base = base.clone();
+                let owner = owner.clone();
+                let repo_id = announcement.id.clone();
+                let mode = self.mode;
+                let declared = declared.clone();
+
+                async move {
+                    let repo = Repo::open(&path)?;
+
+                    match mode {
+                        GitPushMode::Main => repo.push_main(&base, &owner, &repo_id),
+                        GitPushMode::All => {
+                            let mut refspecs = force_refspecs();
+                            if policy == GitPushPolicy::ResetRemote {
+                                let url = format!("{base}/{owner}/{repo_id}.git");
+                                let server_refs = repo.ls_remote(&url)?;
+                                refspecs.extend(deletion_refspecs(&declared, &server_refs));
+                            }
+
+                            let refspecs = refspecs.iter().map(String::as_str).collect::<Vec<_>>();
+                            repo.push_refspecs(&base, &owner, &repo_id, &refspecs)
+                        }
+                    }
+                }
+            });
+
+            match pushed.await {
+                Ok(()) => {
+                    // Run the callback to report the success
+                    on_step(PushStepStatus::Done(step), cx)?;
+
+                    outcome.state_event = Some(event.clone());
+                    outcome.servers.push(GraspServer::ok(relay.clone()));
+                }
+                Err(e) => {
+                    // Run the callback to report the failure
+                    on_step(PushStepStatus::Failed(step, e.to_string()), cx)?;
+
+                    outcome
+                        .servers
+                        .push(GraspServer::failed(relay, e.to_string()));
+                }
+            }
+        }
+
+        // Fan the state out to the relays once a git server holds the objects.
+        if outcome.state_event.is_some() {
+            let step = PushStep::BroadcastStateEvent;
+            on_step(PushStepStatus::Running(step.clone()), cx)?;
+
+            if let Err(e) = client.send_event(&event).broadcast().await {
+                on_step(PushStepStatus::Failed(step, e.to_string()), cx)?;
+                log::warn!("failed to broadcast repository state: {e}");
+            } else {
+                on_step(PushStepStatus::Done(step), cx)?;
+            }
+        }
+
+        Ok(outcome)
+    }
+
+    /// Announce the repository and push the state and objects to the grasp servers.
+    ///
+    /// Both events are signed by the caller, so a failure at the call site can retract the announcement by id.
+    pub async fn announce_and_push<P>(
+        &self,
+        client: &Client,
+        announcement: Event,
+        state_event: Event,
+        cx: &mut AsyncApp,
+        on_step: &mut P,
+    ) -> Result<Event, Error>
+    where
+        P: FnMut(PushStepStatus, &mut AsyncApp) -> Result<(), Error>,
+    {
+        let step = PushStep::AnnounceRepository;
+        on_step(PushStepStatus::Running(step.clone()), cx)?;
+
+        let published = Announcement::from_event(&announcement)
+            .ok_or_else(|| anyhow!("failed to parse announcement"))?;
+
+        // Ensure the relays are connected before sending the announcement event.
+        for url in &published.relays {
+            client.add_relay(url).and_connect().await.ok();
+        }
+
+        let output = client.send_event(&announcement).broadcast().await?;
+
+        // Handle the case where no relay accepted the announcement event.
+        if output.success.is_empty() {
+            let reasons = output
+                .failed
+                .values()
+                .cloned()
+                .collect::<Vec<String>>()
+                .join(", ");
+
+            // Run the callback to report the failure
+            let step = PushStepStatus::Failed(step, format!("event not accepted: {reasons}"));
+            on_step(step, cx)?;
+
+            bail!("event not accepted: {reasons}");
+        }
+
+        on_step(PushStepStatus::Done(step), cx)?;
+
+        let outcome = if self.refs.is_empty() {
+            PushOutcome::default()
+        } else {
+            self.push_to_grasps(client, state_event, &published, cx, on_step)
+                .await?
+        };
+
+        if outcome.accepted() == 0 {
+            bail!(
+                "Repository was announced, but the push to grasp servers failed: {}",
+                outcome.failure_summary()
+            );
+        }
+
+        Ok(announcement)
+    }
+
+    /// Retracts a live announcement; call when `announce_and_push` fails.
+    pub async fn retract_announcement<S>(
+        client: &Client,
+        signer: &S,
+        id: EventId,
+    ) -> Result<(), Error>
+    where
+        S: AsyncGetPublicKey + AsyncSignEvent + ?Sized,
+    {
+        let builder = EventDeletionRequest::new().id(id);
+        let deletion = builder.finalize_async(signer).await?;
+        let output = client.send_event(&deletion).broadcast().await?;
+
+        // Without relay acceptance the deletion request stays live.
+        if output.success.is_empty() {
+            bail!("deletion event not accepted by any relay");
+        }
+
+        Ok(())
+    }
+}
+
+/// Refspecs to force push all heads and tags to the grasp servers.
+fn force_refspecs() -> Vec<String> {
+    vec![
+        "+refs/heads/*:refs/heads/*".to_owned(),
+        "+refs/tags/*:refs/tags/*".to_owned(),
+    ]
+}
+
+/// Refspecs to delete server-only refs from the grasp servers.
+fn deletion_refspecs(declared: &[String], server_refs: &[(String, String)]) -> Vec<String> {
+    server_refs
+        .iter()
+        .filter(|(name, _)| !declared.contains(name))
+        .map(|(name, _)| format!(":{name}"))
+        .collect()
+}

crates/signed_state/src/sync_status.rs

@@ -0,0 +1,367 @@
+use std::cell::RefCell;
+use std::collections::{HashMap, HashSet};
+use std::path::PathBuf;
+use std::time::Duration;
+
+use anyhow::Error;
+use flume::Sender;
+use gpui::{App, AppContext, Context, Entity, EventEmitter, Global, Subscription, Task};
+use signed_core::{Deletions, Filters, RepoAddr};
+use signed_git::{Repo, RepoSyncStatus};
+
+use crate::backend::{Backend, BackendEvent};
+use crate::checkouts::CheckoutsStore;
+use crate::state::SyncState;
+
+const SYNC_POLL: Duration = Duration::from_secs(180);
+const MAX_SYNC_CHECKOUTS: usize = 8;
+
+struct GlobalSyncStatusStore(Entity<SyncStatusStore>);
+
+impl Global for GlobalSyncStatusStore {}
+
+/// A checkout compared against the repository state published on Nostr.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CheckoutSyncStatus {
+    pub path: PathBuf,
+    pub status: RepoSyncStatus,
+}
+
+/// Statuses for these repositories may have changed; empty on signer change.
+#[derive(Debug, Clone)]
+pub enum SyncEvent {
+    Updated(Vec<(RepoAddr, Vec<CheckoutSyncStatus>)>),
+}
+
+/// Probes tracked repositories and broadcasts results. Holds no statuses.
+pub struct SyncStatusStore {
+    active: RefCell<HashSet<RepoAddr>>,
+    in_flight: bool,
+    pass_pending: bool,
+    poll_pending: bool,
+    sender: Sender<()>,
+    tasks: Vec<Task<Result<(), Error>>>,
+    _subscriptions: Vec<Subscription>,
+}
+
+impl EventEmitter<SyncEvent> for SyncStatusStore {}
+
+impl SyncStatusStore {
+    pub fn global(cx: &App) -> Entity<Self> {
+        cx.global::<GlobalSyncStatusStore>().0.clone()
+    }
+
+    pub(crate) fn set_global(entity: Entity<Self>, cx: &mut App) {
+        cx.set_global(GlobalSyncStatusStore(entity));
+    }
+
+    pub fn new(cx: &mut Context<Self>) -> Self {
+        let (sender, receiver) = flume::unbounded::<()>();
+        let mut subscriptions = Vec::new();
+
+        if !cfg!(target_arch = "wasm32") {
+            let backend = Backend::global(cx);
+            let checkouts = CheckoutsStore::global(cx);
+
+            // Checkout associations decide which paths get compared.
+            subscriptions.push(cx.observe(&checkouts, |this, _checkouts, cx| {
+                this.run_pass(cx);
+            }));
+
+            subscriptions.push(
+                cx.subscribe(&backend, |this, _backend, event, cx| match event {
+                    BackendEvent::SignerChanged => this.clear(cx),
+                    BackendEvent::RepoUpdates(_) | BackendEvent::Synced => this.run_pass(cx),
+                    _ => {}
+                }),
+            );
+        }
+
+        let task = cx.spawn(async move |this, cx| {
+            loop {
+                receiver.recv_async().await?;
+
+                // One pass covers every signal queued since the wake.
+                while receiver.try_recv().is_ok() {}
+
+                this.update(cx, |this, cx| {
+                    this.run_pass(cx);
+                })?;
+            }
+        });
+
+        Self {
+            active: RefCell::new(HashSet::new()),
+            sender,
+            in_flight: false,
+            pass_pending: false,
+            poll_pending: false,
+            tasks: vec![task],
+            _subscriptions: subscriptions,
+        }
+    }
+
+    /// Queue a probe pass; folded into any pass already in flight.
+    pub fn probe(&self, addrs: impl IntoIterator<Item = RepoAddr>) {
+        self.active.borrow_mut().extend(addrs);
+
+        if let Err(e) = self.sender.send(()) {
+            log::warn!("failed to queue sync status probe: {e}");
+        }
+    }
+
+    // Keeps the in-flight pass so its completion releases the slot exactly once.
+    fn clear(&mut self, cx: &mut Context<Self>) {
+        let had_addrs = !self.active.borrow().is_empty();
+        self.active.borrow_mut().clear();
+        self.pass_pending = false;
+
+        if had_addrs {
+            cx.emit(SyncEvent::Updated(Vec::new()));
+        }
+    }
+
+    fn run_pass(&mut self, cx: &mut Context<Self>) {
+        if cfg!(target_arch = "wasm32") {
+            return;
+        }
+
+        if self.in_flight {
+            self.pass_pending = true;
+            return;
+        }
+
+        let backend = Backend::global(cx);
+        let client = backend.read(cx).client();
+
+        if backend.read(cx).current_user().is_none() {
+            self.clear(cx);
+            return;
+        }
+
+        if self.active.borrow().is_empty() {
+            return;
+        }
+
+        self.in_flight = true;
+        self.schedule_poll(cx);
+
+        let targets: Vec<(RepoAddr, Vec<PathBuf>)> = {
+            let active = self.active.borrow();
+            let checkouts = CheckoutsStore::global(cx);
+
+            active
+                .iter()
+                .map(|addr| {
+                    let paths = checkouts.read(cx).associations_of(addr);
+                    (addr.clone(), paths)
+                })
+                .collect()
+        };
+
+        let work = cx.background_spawn(async move {
+            let db = client.database();
+            let deletion_events = db.query(Filters::deletions()).await?;
+            let deletions = Deletions::from_events(deletion_events);
+
+            let mut updates: Vec<(RepoAddr, Vec<CheckoutSyncStatus>)> = Vec::new();
+
+            for (addr, paths) in &targets {
+                let events = db.query(addr.state_filter()).await?;
+                let latest = utils::latest(
+                    events
+                        .into_iter()
+                        .filter(|event| !deletions.is_deleted(event)),
+                );
+
+                let Some(event) = latest else {
+                    updates.push((addr.clone(), Vec::new()));
+                    continue;
+                };
+
+                let remote_refs: Vec<(String, String)> = SyncState::parse(&event)
+                    .refs
+                    .iter()
+                    .map(|git_ref| (git_ref.name.clone(), git_ref.commit.to_string()))
+                    .collect();
+
+                let mut list = Vec::new();
+                for path in paths.iter().take(MAX_SYNC_CHECKOUTS) {
+                    let synced =
+                        Repo::try_open(path).and_then(|repo| repo.sync_status(&remote_refs).ok());
+
+                    if let Some(status) = synced {
+                        list.push(CheckoutSyncStatus {
+                            path: path.clone(),
+                            status,
+                        });
+                    }
+                }
+
+                updates.push((addr.clone(), list));
+            }
+
+            Ok::<_, Error>(updates)
+        });
+
+        self.tasks.push(cx.spawn(async move |this, cx| {
+            // Reset the slot even on failure, or every later pass folds forever.
+            let updates = match work.await {
+                Ok(updates) => updates,
+                Err(error) => {
+                    log::warn!("failed to compute nostr sync statuses: {error}");
+                    Vec::new()
+                }
+            };
+
+            let mut again = false;
+
+            this.update(cx, |this, cx| {
+                this.in_flight = false;
+                if !updates.is_empty() {
+                    cx.emit(SyncEvent::Updated(updates));
+                }
+                again = std::mem::take(&mut this.pass_pending);
+            })?;
+
+            if again {
+                this.update(cx, |this, cx| {
+                    this.run_pass(cx);
+                })?;
+            }
+
+            Ok::<(), anyhow::Error>(())
+        }));
+    }
+
+    fn schedule_poll(&mut self, cx: &mut Context<Self>) {
+        if self.poll_pending {
+            return;
+        }
+        self.poll_pending = true;
+
+        self.tasks.push(cx.spawn(async move |this, cx| {
+            cx.background_executor().timer(SYNC_POLL).await;
+
+            this.update(cx, |this, cx| {
+                this.poll_pending = false;
+                this.run_pass(cx);
+            })?;
+
+            Ok::<(), anyhow::Error>(())
+        }));
+    }
+}
+
+/// Sync status cache bound to one panel or screen.
+pub struct SyncStatusDirectory {
+    statuses: HashMap<RepoAddr, Vec<CheckoutSyncStatus>>,
+    pending: RefCell<HashSet<RepoAddr>>,
+    _subscriptions: Vec<Subscription>,
+}
+
+impl SyncStatusDirectory {
+    /// Create a directory, following the sync store's events.
+    pub fn new(cx: &mut App) -> Entity<Self> {
+        let store = SyncStatusStore::global(cx);
+
+        cx.new(|cx| {
+            let subscription =
+                cx.subscribe(&store, |this: &mut Self, _store, event, cx| match event {
+                    SyncEvent::Updated(updates) => this.apply(updates.clone(), cx),
+                });
+
+            Self {
+                statuses: HashMap::new(),
+                pending: RefCell::new(HashSet::new()),
+                _subscriptions: vec![subscription],
+            }
+        })
+    }
+
+    /// Queue a probe for addrs this surface renders.
+    pub fn track(&mut self, addrs: impl IntoIterator<Item = RepoAddr>, cx: &mut Context<Self>) {
+        let missing: Vec<RepoAddr> = addrs
+            .into_iter()
+            .filter(|addr| {
+                !self.statuses.contains_key(addr)
+                    && !self.with_pending(|pending| pending.contains(addr))
+            })
+            .collect();
+
+        if missing.is_empty() {
+            return;
+        }
+
+        self.with_pending(|pending| pending.extend(missing.iter().cloned()));
+
+        let store = SyncStatusStore::global(cx);
+        store.read(cx).probe(missing);
+    }
+
+    /// Statuses for a repo, or empty; a miss queues a probe.
+    pub fn statuses_of(&self, addr: &RepoAddr, cx: &App) -> Vec<CheckoutSyncStatus> {
+        self.queue(addr, cx);
+        self.statuses.get(addr).cloned().unwrap_or_default()
+    }
+
+    /// Commits available locally but missing on Nostr.
+    pub fn unsynced(&self, addr: &RepoAddr, cx: &App) -> usize {
+        self.queue(addr, cx);
+
+        self.statuses
+            .get(addr)
+            .map(|list| {
+                list.iter()
+                    .map(|checkout| checkout.status.ahead_total)
+                    .sum()
+            })
+            .unwrap_or(0)
+    }
+
+    fn queue(&self, addr: &RepoAddr, cx: &App) {
+        if self.with_pending(|pending| pending.insert(addr.clone())) {
+            let store = SyncStatusStore::global(cx);
+            store.read(cx).probe([addr.clone()]);
+        }
+    }
+
+    fn apply(&mut self, updates: Vec<(RepoAddr, Vec<CheckoutSyncStatus>)>, cx: &mut Context<Self>) {
+        if updates.is_empty() {
+            let changed = !self.statuses.is_empty();
+            self.statuses.clear();
+            self.with_pending(|pending| pending.clear());
+
+            if changed {
+                cx.notify();
+            }
+
+            return;
+        }
+
+        let mut changed = false;
+
+        for (addr, list) in updates {
+            let relevant = self.statuses.contains_key(&addr)
+                || self.with_pending(|pending| pending.remove(&addr));
+
+            if !relevant {
+                continue;
+            }
+
+            if self.statuses.get(&addr) != Some(&list) {
+                self.statuses.insert(addr, list);
+                changed = true;
+            }
+        }
+
+        if changed {
+            cx.notify();
+        }
+    }
+
+    fn with_pending<R>(&self, then: impl FnOnce(&mut HashSet<RepoAddr>) -> R) -> R {
+        let mut pending = self.pending.borrow_mut();
+        then(&mut pending)
+    }
+}

crates/signed_ui/src/avatar.rs

@@ -1,38 +1,110 @@
+use std::fmt::Display;
+
 use gpui::prelude::*;
-use gpui::{App, Pixels, StyleRefinement, Window, div, px};
-use gpui_base::StyledExt;
-use gpui_component::{ActiveTheme, Colorize};
+use gpui::{App, Pixels, SharedString, StyleRefinement, Window, div, px};
+use gpui_base::{AvatarImage, StyledExt};
+use gpui_component::{ActiveTheme, Colorize, Sizable, Size};
 
 /// Number of rows and columns in the pixel grid.
 const GRID_SIZE: usize = 8;
-/// Probability that a cell in the left half is filled.
+/// Empty cells kept between the pattern and the avatar edge.
+const MARGIN: usize = 1;
+/// Probability that a cell in the left half of the pattern area is filled.
 const FILL_PROBABILITY: f32 = 0.42;
 /// Probability that a filled cell uses the accent shade instead of the main color.
 const ACCENT_PROBABILITY: f32 = 0.25;
-/// Minimum number of filled left-half cells, so a sparse roll still yields a
-/// recognizable shape (each left-half cell is mirrored to a right-half one).
+/// Minimum number of filled left-half cells.
 const MIN_FILLED: usize = 5;
 
-/// A deterministic, offline "pixel art" avatar: an 8×8 grid with horizontal
-/// mirror symmetry, seeded from a stable string such as the repository id and
-/// owner public key. The same seed always renders the same avatar.
+/// An avatar for a user or other entity.
 #[derive(IntoElement)]
-pub struct PixelAvatar {
-    seed: u64,
-    size: Pixels,
+pub struct Avatar {
+    id: SharedString,
+    name: Option<SharedString>,
+    picture: Option<SharedString>,
+    size: Size,
     style: StyleRefinement,
 }
 
-impl PixelAvatar {
-    /// Create an avatar seeded from `seed`. The seed should be a stable string
-    /// unique to the entity the avatar represents.
-    pub fn new(seed: impl AsRef<str>) -> Self {
+impl Avatar {
+    /// Create an avatar for `id`, a public key or any other stable string.
+    ///
+    /// The id seeds the pixel fallback shown when no picture is set.
+    pub fn new<T>(id: T) -> Self
+    where
+        T: Display,
+    {
         Self {
-            seed: fnv1a(seed.as_ref().as_bytes()),
-            size: px(16.),
+            id: id.to_string().into(),
+            name: None,
+            picture: None,
+            size: Size::Small,
             style: StyleRefinement::default(),
         }
     }
+
+    /// The display name of the avatar's subject, if known.
+    pub fn name<T>(mut self, name: T) -> Self
+    where
+        T: Into<Option<SharedString>>,
+    {
+        self.name = name.into();
+        self
+    }
+
+    /// The user's picture URL, if known.
+    pub fn picture<T>(mut self, picture: Option<T>) -> Self
+    where
+        T: Into<SharedString>,
+    {
+        self.picture = picture.map(Into::into);
+        self
+    }
+}
+
+impl Sizable for Avatar {
+    fn with_size(mut self, size: impl Into<Size>) -> Self {
+        self.size = size.into();
+        self
+    }
+}
+
+impl Styled for Avatar {
+    fn style(&mut self) -> &mut StyleRefinement {
+        &mut self.style
+    }
+}
+
+impl RenderOnce for Avatar {
+    fn render(self, _window: &mut Window, cx: &mut App) -> impl IntoElement {
+        let radius = cx.theme().radius;
+
+        match self.picture {
+            Some(url) => div()
+                .size(side_length(self.size))
+                .flex_shrink_0()
+                .rounded(radius)
+                .overflow_hidden()
+                .bg(cx.theme().secondary)
+                .child(AvatarImage::new(url).size_full().rounded(radius))
+                .refine_style(&self.style)
+                .into_any_element(),
+            None => PixelAvatar {
+                seed: fnv1a(self.id.as_bytes()),
+                side: side_length(self.size),
+                style: self.style,
+            }
+            .into_any_element(),
+        }
+    }
+}
+
+/// A deterministic, offline pixel-art avatar.
+#[derive(IntoElement)]
+struct PixelAvatar {
+    seed: u64,
+    side: Pixels,
+    style: StyleRefinement,
 }
 
 impl Styled for PixelAvatar {
@@ -45,16 +117,17 @@ impl RenderOnce for PixelAvatar {
     fn render(self, _window: &mut Window, cx: &mut App) -> impl IntoElement {
         let theme = cx.theme();
         let pattern = pattern(self.seed);
+        let mut cells = Vec::new();
 
         let hue = self.seed as f32 / u64::MAX as f32;
         let main = theme.blue.hue(hue);
+
         let shade = if theme.is_dark() {
             main.lightness((main.l * 1.6).min(0.95))
         } else {
             main.lightness((main.l * 0.45).max(0.18))
         };
 
-        let mut cells = Vec::new();
         for row in 0..GRID_SIZE {
             for col in 0..GRID_SIZE {
                 let value = pattern[row * GRID_SIZE + col];
@@ -73,27 +146,42 @@ impl RenderOnce for PixelAvatar {
         }
 
         div()
-            .refine_style(&self.style)
             .grid()
             .grid_cols(GRID_SIZE as u16)
             .grid_rows(GRID_SIZE as u16)
-            .size(self.size)
+            .size(self.side)
             .flex_shrink_0()
+            .rounded(theme.radius)
             .overflow_hidden()
             .bg(main.opacity(0.16))
             .children(cells)
+            .refine_style(&self.style)
+    }
+}
+
+/// The rendered side length of an avatar at `size`.
+fn side_length(size: Size) -> Pixels {
+    match size {
+        Size::XSmall => px(16.),
+        Size::Small => px(24.),
+        Size::Medium => px(48.),
+        Size::Large => px(80.),
+        Size::Size(size) => size,
     }
 }
 
-/// Generate the 8×8 cell pattern for `seed`. Cells are `0` (empty), `1`
-/// (main color) or `2` (accent shade); the right half mirrors the left half.
 fn pattern(seed: u64) -> [u8; GRID_SIZE * GRID_SIZE] {
     let mut rng = PixelRng::new(seed);
     let mut pattern = [0u8; GRID_SIZE * GRID_SIZE];
     let mut filled = 0usize;
 
-    for row in 0..GRID_SIZE {
-        for col in 0..GRID_SIZE / 2 {
+    // Only the inner rows and the inner left half are candidates; mirroring
+    // then keeps the art within the same inset, leaving the outer ring empty.
+    let art_rows = GRID_SIZE - 2 * MARGIN;
+    let art_columns = GRID_SIZE / 2 - MARGIN;
+
+    for row in MARGIN..GRID_SIZE - MARGIN {
+        for col in MARGIN..GRID_SIZE / 2 {
             if rng.chance(FILL_PROBABILITY) {
                 let accent = rng.chance(ACCENT_PROBABILITY);
                 set_cell(&mut pattern, row, col, if accent { 2 } else { 1 });
@@ -102,18 +190,19 @@ fn pattern(seed: u64) -> [u8; GRID_SIZE * GRID_SIZE] {
         }
     }
 
-    // Sparse rolls can come out nearly empty; top the pattern up to the
-    // minimum fill, scanning from a seeded starting cell.
     if filled < MIN_FILLED {
-        let half = GRID_SIZE * GRID_SIZE / 2;
-        let start = (rng.next() % half as u64) as usize;
-        for offset in 0..half {
+        let total = art_rows * art_columns;
+        let start = (rng.next() % total as u64) as usize;
+
+        for offset in 0..total {
             if filled >= MIN_FILLED {
                 break;
             }
-            let ix = (start + offset) % half;
-            let row = ix / (GRID_SIZE / 2);
-            let col = ix % (GRID_SIZE / 2);
+
+            let ix = (start + offset) % total;
+            let row = MARGIN + ix / art_columns;
+            let col = MARGIN + ix % art_columns;
+
             if pattern[row * GRID_SIZE + col] == 0 {
                 set_cell(&mut pattern, row, col, 1);
                 filled += 1;
@@ -130,7 +219,7 @@ fn set_cell(pattern: &mut [u8; GRID_SIZE * GRID_SIZE], row: usize, col: usize, v
     pattern[row * GRID_SIZE + (GRID_SIZE - 1 - col)] = value;
 }
 
-/// FNV-1a 64-bit hash; stable across platforms and runs.
+/// FNV-1a 64-bit hash, stable across platforms and runs.
 fn fnv1a(bytes: &[u8]) -> u64 {
     let mut hash = 0xcbf2_9ce4_8422_2325u64;
     for &byte in bytes {
@@ -161,54 +250,3 @@ impl PixelRng {
         self.next() as f32 / (u64::MAX as f32) < probability
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn count_filled(pattern: &[u8; GRID_SIZE * GRID_SIZE]) -> usize {
-        pattern.iter().filter(|&&cell| cell != 0).count()
-    }
-
-    #[test]
-    fn pattern_is_mirror_symmetric() {
-        for seed in 0..50 {
-            let pattern = pattern(seed);
-            for row in 0..GRID_SIZE {
-                for col in 0..GRID_SIZE {
-                    assert_eq!(
-                        pattern[row * GRID_SIZE + col],
-                        pattern[row * GRID_SIZE + (GRID_SIZE - 1 - col)],
-                        "asymmetric pattern for seed {seed} at ({row}, {col})"
-                    );
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn pattern_has_minimum_fill() {
-        for seed in 0..50 {
-            let pattern = pattern(seed);
-            assert!(
-                count_filled(&pattern) >= MIN_FILLED * 2,
-                "pattern too sparse for seed {seed}"
-            );
-        }
-    }
-
-    #[test]
-    fn pattern_is_deterministic() {
-        for seed in [0, 1, 42, u64::MAX] {
-            assert_eq!(pattern(seed), pattern(seed));
-        }
-        assert_ne!(pattern(42), pattern(43));
-    }
-
-    #[test]
-    fn fnv1a_is_stable_and_distinct() {
-        assert_eq!(fnv1a(b""), 0xcbf2_9ce4_8422_2325);
-        assert_eq!(fnv1a(b"repo"), fnv1a(b"repo"));
-        assert_ne!(fnv1a(b"repo:a"), fnv1a(b"repo:b"));
-    }
-}

crates/signed_ui/src/copy_row.rs

@@ -4,12 +4,14 @@ use gpui_component::clipboard::Clipboard;
 use gpui_component::menu::PopupMenuItem;
 use gpui_component::{ActiveTheme, StyledExt, h_flex};
 
-/// A muted command row with a copy button: the value in a mono-friendly,
-/// truncated line, with a [`Clipboard`] button copying the full value.
-pub fn copy_row<E>(copy_id: E, command: &SharedString, cx: &App) -> Div
+/// A muted command row with a copy button.
+pub fn copy_row<E, T>(copy_id: E, command: T, cx: &App) -> Div
 where
     E: Into<ElementId>,
+    T: Into<SharedString>,
 {
+    let command = command.into();
+
     h_flex()
         .h_8()
         .w_full()
@@ -34,10 +36,7 @@ where
         )
 }
 
-/// One row of a copy menu: a small title above the compact label, with
-/// a copy button that flips to a check while the value is on the clipboard.
-/// Clicking the row copies and dismisses the menu; the copy button stops
-/// propagation so the menu stays open. Both copy `copy`, never the label.
+/// One row of a copy menu, with a small title above the compact label.
 pub fn menu_copy_row(
     id: &'static str,
     title: &'static str,

crates/signed_ui/src/dropdown_button.rs

@@ -7,24 +7,19 @@ use gpui_base::{Button as BaseButton, Popover, Selectable, StyledExt};
 use gpui_component::menu::PopupMenu;
 use gpui_component::{ActiveTheme, Icon, IconName, Sizable, h_flex};
 
-/// A split dropdown button built on `gpui_base::Popover`: an action element
-/// with a separate caret trigger that opens a [`PopupMenu`].
-///
-/// The action and the caret are caller-supplied elements, so the look stays
-/// in the application; this component only owns the popover wiring.
+/// A split dropdown button built on `gpui_base::Popover`.
+/// An action element next to a caret that opens a [`PopupMenu`].
 #[derive(IntoElement)]
 pub struct DropdownButton {
     id: ElementId,
     style: StyleRefinement,
     anchor: Anchor,
     action: Option<AnyElement>,
-    caret: Option<CaretBuilder>,
     menu: Option<MenuBuilder>,
 }
 
 type MenuBuilder =
     Box<dyn Fn(PopupMenu, &mut Window, &mut Context<PopupMenu>) -> PopupMenu + 'static>;
-type CaretBuilder = Box<dyn FnOnce(bool, &Window, &App) -> AnyElement>;
 
 impl DropdownButton {
     pub fn new(id: impl Into<ElementId>) -> Self {
@@ -33,20 +28,20 @@ impl DropdownButton {
             style: StyleRefinement::default(),
             anchor: Anchor::TopRight,
             action: None,
-            caret: None,
             menu: None,
         }
     }
 
-    /// The action half of the button. It keeps its own icon, label, tooltip
-    /// and click handler.
+    /// The action half of the button.
+    /// It keeps its own icon, label, tooltip and click handler.
     pub fn action(mut self, action: impl IntoElement + 'static) -> Self {
         self.action = Some(action.into_any_element());
         self
     }
 
-    /// The menu built by `builder` — the same signature as gpui-component's
-    /// `DropdownButton::dropdown_menu`, so existing menu code keeps working.
+    /// The menu built by `builder`.
+    /// Matches gpui-component's `DropdownButton::dropdown_menu` signature.
+    /// Existing menu code keeps working.
     pub fn dropdown_menu(
         mut self,
         builder: impl Fn(PopupMenu, &mut Window, &mut Context<PopupMenu>) -> PopupMenu + 'static,
@@ -54,15 +49,6 @@ impl DropdownButton {
         self.menu = Some(Box::new(builder));
         self
     }
-
-    /// Which corner of the caret the menu anchors to. Defaults to
-    /// [`Anchor::TopRight`], so the menu's right edge lines up with the
-    /// caret's.
-    #[allow(dead_code)] // API knob; current call sites use the default anchor.
-    pub fn anchor(mut self, anchor: impl Into<Anchor>) -> Self {
-        self.anchor = anchor.into();
-        self
-    }
 }
 
 impl Styled for DropdownButton {
@@ -71,8 +57,8 @@ impl Styled for DropdownButton {
     }
 }
 
-/// Holds the [`PopupMenu`] entity of one popover between renders. Dismissal
-/// drops it, so the menu is rebuilt with fresh items on the next open.
+/// Holds the [`PopupMenu`] entity of one popover between renders.
+/// Dismissal drops it, so the menu is rebuilt with fresh items on the next open.
 #[derive(Default)]
 struct DropdownMenuState {
     menu: Option<Entity<PopupMenu>>,
@@ -85,34 +71,31 @@ impl RenderOnce for DropdownButton {
             "a DropdownButton needs a `dropdown_menu`"
         );
 
-        // The popover needs its own id: both the container and the popover register keyed state on this window.
+        // The popover needs its own id.
+        // The container and the popover both register keyed state on this window.
         let popover_id = SharedString::from(format!("{}-popover", self.id));
         let anchor = self.anchor;
         let menu_state =
             window.use_keyed_state(popover_id.clone(), cx, |_, _| DropdownMenuState::default());
 
-        let caret = self.caret.unwrap_or_else(|| {
-            let id = popover_id.clone();
-            Box::new(move |is_open, _, cx| {
-                let caret = default_caret(id.clone(), cx);
-                let selected = caret.is_selected();
-                caret.selected(selected || is_open).into_any_element()
-            })
-        });
-
         h_flex()
             .id(self.id)
             .refine_style(&self.style)
             .gap_0p5()
             .when_some(self.action, |this, action| this.child(action))
             .when_some(self.menu, |this, builder| {
+                let caret_id = popover_id.clone();
                 this.child(
                     Popover::new(popover_id)
                         .anchor(anchor)
-                        // The menu dismisses itself on outside click or Escape;
-                        // the subscription below closes the popover along with it.
+                        // The menu dismisses itself on outside click or Escape.
+                        // The subscription below closes the popover along with it.
                         .overlay_closable(false)
-                        .trigger_with(caret)
+                        .trigger_with(move |is_open, _, cx| {
+                            let caret = default_caret(caret_id.clone(), cx);
+                            let selected = caret.is_selected();
+                            caret.selected(selected || is_open).into_any_element()
+                        })
                         .content(
                             move |_, window, cx| match menu_state.read(cx).menu.clone() {
                                 Some(menu) => menu,
@@ -148,8 +131,8 @@ impl RenderOnce for DropdownButton {
     }
 }
 
-/// The default caret: a chevron button the height of a medium button, tinted
-/// by the theme, with hover and menu-open states.
+/// The default caret, a chevron button the height of a medium button.
+/// It is tinted by the theme and styled for hover and menu-open states.
 fn default_caret(id: impl Into<ElementId>, cx: &App) -> BaseButton {
     BaseButton::new(id)
         .h(px(32.))
@@ -162,24 +145,3 @@ fn default_caret(id: impl Into<ElementId>, cx: &App) -> BaseButton {
         })
         .child(Icon::new(IconName::ChevronDown).xsmall())
 }
-
-#[cfg(test)]
-mod tests {
-    use gpui::div;
-
-    use super::*;
-
-    #[test]
-    fn dropdown_button_builder_state() {
-        let button = DropdownButton::new("issues")
-            .action(div())
-            .anchor(Anchor::BottomLeft)
-            .dropdown_menu(|menu, _, _| menu);
-
-        assert!(button.action.is_some());
-        // The caret is `None` until render, which falls back to the default.
-        assert!(button.caret.is_none());
-        assert!(button.menu.is_some());
-        assert_eq!(button.anchor, Anchor::BottomLeft);
-    }
-}

crates/signed_ui/src/image_cache.rs

@@ -1,139 +0,0 @@
-use std::collections::{HashMap, VecDeque};
-use std::mem::take;
-
-use futures::FutureExt;
-use gpui::{
-    App, AppContext, Asset, AssetLogger, ElementId, Entity, ImageAssetLoader, ImageCache,
-    ImageCacheItem, ImageCacheProvider, ImageSource, Resource, hash,
-};
-
-/// Default number of images each view's cache retains. Loading a new image
-/// evicts the least recently used entry once this is reached.
-pub const MAX_IMAGES: usize = 128;
-
-pub fn image_cache(id: impl Into<ElementId>, max_items: usize) -> AppImageCacheProvider {
-    AppImageCacheProvider {
-        id: id.into(),
-        max_items,
-    }
-}
-
-pub struct AppImageCacheProvider {
-    id: ElementId,
-    max_items: usize,
-}
-
-impl ImageCacheProvider for AppImageCacheProvider {
-    fn provide(&mut self, window: &mut gpui::Window, cx: &mut App) -> gpui::AnyImageCache {
-        window
-            .with_global_id(self.id.clone(), |id, window| {
-                window.with_element_state(id, |cache, _| {
-                    let cache = cache.unwrap_or_else(|| AppImageCache::new(self.max_items, cx));
-                    (cache.clone(), cache)
-                })
-            })
-            .into()
-    }
-}
-
-pub struct AppImageCache {
-    max_items: usize,
-    usage_list: VecDeque<u64>,
-    cache: HashMap<u64, (ImageCacheItem, Resource)>,
-}
-
-impl AppImageCache {
-    pub fn new(max_items: usize, cx: &mut App) -> Entity<Self> {
-        cx.new(|cx| {
-            log::info!("Creating AppImageCacheProvider");
-            cx.on_release(|this: &mut Self, cx| {
-                for (ix, (mut image, resource)) in take(&mut this.cache) {
-                    if let Some(Ok(image)) = image.get() {
-                        log::info!("Dropping image {ix}");
-                        cx.drop_image(image, None);
-                    }
-                    ImageSource::Resource(resource).remove_asset(cx);
-                }
-            })
-            .detach();
-
-            AppImageCache {
-                max_items,
-                usage_list: VecDeque::with_capacity(max_items),
-                cache: HashMap::with_capacity(max_items),
-            }
-        })
-    }
-}
-
-impl ImageCache for AppImageCache {
-    fn load(
-        &mut self,
-        resource: &Resource,
-        window: &mut gpui::Window,
-        cx: &mut gpui::App,
-    ) -> Option<Result<std::sync::Arc<gpui::RenderImage>, gpui::ImageCacheError>> {
-        let hash = hash(resource);
-
-        if let Some(item) = self.cache.get_mut(&hash) {
-            let current_idx = self
-                .usage_list
-                .iter()
-                .position(|item| *item == hash)
-                .expect("cache has an item usage_list doesn't");
-
-            self.usage_list.remove(current_idx);
-            self.usage_list.push_front(hash);
-
-            return item.0.get();
-        }
-
-        let load_future = AssetLogger::<ImageAssetLoader>::load(resource.clone(), cx);
-        let task = cx.background_executor().spawn(load_future).shared();
-
-        if self.usage_list.len() >= self.max_items {
-            log::info!("Image cache is full, evicting oldest item");
-
-            if let Some(oldest) = self.usage_list.pop_back() {
-                let mut image = self
-                    .cache
-                    .remove(&oldest)
-                    .expect("usage_list has an item cache doesn't");
-
-                if let Some(Ok(image)) = image.0.get() {
-                    log::info!("requesting image to be dropped");
-                    cx.drop_image(image, Some(window));
-                }
-
-                ImageSource::Resource(image.1).remove_asset(cx);
-            }
-        }
-
-        self.cache.insert(
-            hash,
-            (
-                gpui::ImageCacheItem::Loading(task.clone()),
-                resource.clone(),
-            ),
-        );
-        self.usage_list.push_front(hash);
-
-        let entity = window.current_view();
-
-        window
-            .spawn(cx, async move |cx| {
-                let result = task.await;
-
-                if let Err(err) = result {
-                    log::error!("error loading image into cache: {:?}", err);
-                }
-
-                cx.on_next_frame(move |_, cx| {
-                    cx.notify(entity);
-                });
-            })
-            .detach();
-
-        None
-    }
-}

crates/signed_ui/src/lib.rs

@@ -1,58 +1,24 @@
-//! Reusable UI components and elements for Signed.
-//!
-//! Everything here is presentation-only: the components read theme tokens
-//! through [`gpui_component::ActiveTheme`] and render with plain GPUI
-//! elements, so any view in the app can use them without depending on app
-//! state. They are built on the unstyled `gpui-base` primitives and the
-//! styled `gpui-component` library.
-//!
-//! The crate is organized by component:
-//!
-//! - [`PixelAvatar`] — deterministic, offline "pixel art" avatar
-//! - [`NavItem`] — sidebar navigation row (leading element + label + suffix)
-//! - [`DropdownButton`] — split button: an action plus a caret that opens a
-//!   [`PopupMenu`], wired through `gpui_base::Popover`
-//! - [`SegmentButton`] / [`CountBadge`] — segmented filter/tab button with an
-//!   optional count badge
-//! - [`UserAvatar`] — user picture avatar with a name-initials fallback
-//! - [`status_badge`] — NIP-34 issue/PR status badge
-//! - [`placeholder`] — centered muted placeholder message
-//! - [`copy_row`] / [`menu_copy_row`] — rows with a copy-to-clipboard button
-//! - [`tree_row`] — one row of a file tree
-//! - [`setting_row`] / [`setting_block`] — label + description rows for a
-//!   settings dialog, with the control on the right (row) or below (block)
-//! - [`SelectOption`] — dropdown option with a display label and a stored
-//!   value
-//! - [`title_bar_drag_handlers`] — make an element behave like a window
-//!   title bar (drag moves the window, double-click zooms)
-//! - [`image_cache`] — per-view LRU image cache provider
-//! - [`middle_truncate`] — `[head]...[tail]` string truncation
-
+mod avatar;
 mod dropdown_button;
 mod nav_item;
-mod pixel_avatar;
 mod placeholder;
+mod ref_selector;
 mod segment_button;
 mod setting;
 mod status_badge;
 mod title_bar;
 mod tree_row;
-mod user_avatar;
 
 pub mod copy_row;
-pub mod image_cache;
-pub mod util;
 
+pub use avatar::Avatar;
 pub use copy_row::{copy_row, menu_copy_row};
 pub use dropdown_button::DropdownButton;
-pub use image_cache::{MAX_IMAGES, image_cache};
 pub use nav_item::NavItem;
-pub use pixel_avatar::PixelAvatar;
 pub use placeholder::placeholder;
+pub use ref_selector::ref_selector_trigger;
 pub use segment_button::{CountBadge, SegmentButton};
 pub use setting::{SelectOption, setting_block, setting_row};
 pub use status_badge::status_badge;
 pub use title_bar::title_bar_drag_handlers;
 pub use tree_row::tree_row;
-pub use user_avatar::UserAvatar;
-pub use util::middle_truncate;

crates/signed_ui/src/nav_item.rs

@@ -2,9 +2,10 @@ use gpui::prelude::*;
 use gpui::{App, ClickEvent, ElementId, SharedString, StyleRefinement, Window, div};
 use gpui_component::{ActiveTheme, StyledExt, h_flex};
 
-/// A single navigation entry in a sidebar: an arbitrary leading element
-/// (an icon, avatar, ...) and a text label with a hover highlight,
-/// an optional trailing suffix (e.g. a status icon) and an optional click handler.
+/// A single navigation entry in a sidebar.
+/// It has an arbitrary leading element, such as an icon or avatar, and a text label.
+/// Hover highlights the row.
+/// It can carry a trailing suffix, such as a status icon, and an optional click handler.
 #[allow(clippy::type_complexity)]
 #[derive(IntoElement)]
 pub struct NavItem {
@@ -12,7 +13,7 @@ pub struct NavItem {
     style: StyleRefinement,
     icon: gpui::AnyElement,
     label: SharedString,
-    /// Trailing element rendered at the right edge of the row, after the (ellipsized) label.
+    /// Trailing element at the right edge of the row, after the ellipsized label.
     suffix: Option<gpui::AnyElement>,
     on_click: Option<Box<dyn Fn(&ClickEvent, &mut Window, &mut App) + 'static>>,
 }
@@ -34,7 +35,6 @@ impl NavItem {
         }
     }
 
-    /// A trailing element rendered at the right edge of the row
     pub fn suffix(mut self, suffix: impl IntoElement) -> Self {
         self.suffix = Some(suffix.into_any_element());
         self

crates/signed_ui/src/ref_selector.rs

@@ -0,0 +1,41 @@
+use assets::CustomIconName;
+use gpui::prelude::*;
+use gpui::{AnyElement, App, SharedString, div};
+use gpui_component::combobox::{Caret, ComboboxTriggerContext};
+use gpui_component::searchable_list::SearchableVec;
+use gpui_component::{ActiveTheme, Icon, Sizable, h_flex};
+
+/// The kind icon, the selection or placeholder, and the caret. `Combobox`
+/// replaces its default trigger entirely, the only way to show an icon inside it.
+pub fn ref_selector_trigger(
+    ctx: &ComboboxTriggerContext<SearchableVec<SharedString>>,
+    icon: CustomIconName,
+    cx: &App,
+) -> AnyElement {
+    let muted = cx.theme().muted_foreground;
+
+    h_flex()
+        .w_full()
+        .min_w_0()
+        .gap_1()
+        .items_center()
+        .child(Icon::new(icon).small().flex_shrink_0())
+        .child(
+            div()
+                .flex_1()
+                .min_w_0()
+                .overflow_hidden()
+                .text_ellipsis()
+                .whitespace_nowrap()
+                .when(ctx.selection().is_empty(), |this| this.text_color(muted))
+                .child(
+                    ctx.selection()
+                        .first()
+                        .map(|(_, item)| item.clone())
+                        .or_else(|| ctx.placeholder().cloned())
+                        .unwrap_or_default(),
+                ),
+        )
+        .child(Caret::new(ctx.size()).text_color(muted))
+        .into_any_element()
+}

crates/signed_ui/src/segment_button.rs

@@ -3,9 +3,7 @@ use gpui::{App, ClickEvent, ElementId, SharedString, StyleRefinement, Window, di
 use gpui_base::{Button as BaseButton, StyledExt};
 use gpui_component::ActiveTheme;
 
-/// A small count badge shown after a label, e.g. on a segmented filter
-/// button ("All 12") or a tab. Rendered from theme tokens; sized for the
-/// compact header buttons it lives on.
+/// A small count badge shown after a label.
 #[derive(IntoElement)]
 pub struct CountBadge {
     count: usize,
@@ -46,12 +44,11 @@ impl RenderOnce for CountBadge {
     }
 }
 
-/// A segmented filter/tab button: an icon, a label, an optional [`CountBadge`]
-/// and a selected (pressed) state, styled from the theme's button tokens.
-///
-/// Built on the unstyled `gpui_base::Button`, like the app's other custom
-/// controls; the `primary` variant uses the primary button tokens for
-/// call-to-action buttons ("New issue", "New PR").
+/// A segmented filter/tab button with an icon, a label and an optional [`CountBadge`].
+/// The selected state renders the button pressed, styled from theme button tokens.
+/// Built on the unstyled `gpui_base::Button`, like the app's other custom controls.
+/// The `primary` variant uses the primary button tokens.
+/// It suits call-to-action buttons such as `New issue` and `New PR`.
 #[allow(clippy::type_complexity)]
 #[derive(IntoElement)]
 pub struct SegmentButton {
@@ -101,7 +98,7 @@ impl SegmentButton {
         self
     }
 
-    /// Use the primary button tokens (for call-to-action buttons).
+    /// Use the primary button tokens, for call-to-action buttons.
     pub fn primary(mut self) -> Self {
         self.primary = true;
         self

crates/signed_ui/src/setting.rs

@@ -1,15 +1,9 @@
-//! Reusable settings UI: rows and blocks for building a settings dialog, plus
-//! a labeled dropdown option.
-
 use gpui::prelude::*;
 use gpui::{App, SharedString, div};
 use gpui_component::searchable_list::SearchableListItem;
 use gpui_component::{ActiveTheme, StyledExt, h_flex, v_flex};
 
 /// A dropdown option with a display label and a stored value.
-///
-/// Renders the `label` in the trigger and the menu, while `value` is what a
-/// [`gpui_component::select::SelectState`] reports as the selection.
 #[derive(Clone)]
 pub struct SelectOption {
     value: SharedString,
@@ -25,12 +19,10 @@ impl SelectOption {
         }
     }
 
-    /// The stored value of this option.
     pub fn value(&self) -> &SharedString {
         &self.value
     }
 
-    /// The display label of this option.
     pub fn label(&self) -> &SharedString {
         &self.label
     }
@@ -48,7 +40,7 @@ impl SearchableListItem for SelectOption {
     }
 }
 
-/// A settings row: label + description on the left, control on the right.
+/// A settings row with the label and description on the left and the control on the right.
 pub fn setting_row(
     cx: &App,
     title: impl Into<SharedString>,
@@ -85,8 +77,7 @@ pub fn setting_row(
         )
 }
 
-/// A full-width settings block: title + subtitle in one header, `gap_3`
-/// between the header and the control below.
+/// A full-width settings block with title and subtitle in one header.
 pub fn setting_block(
     cx: &App,
     title: impl Into<SharedString>,

crates/signed_ui/src/status_badge.rs

@@ -5,16 +5,15 @@ use gpui_component::tooltip::Tooltip;
 use gpui_component::{ActiveTheme, Icon, Sizable, v_flex};
 use signed_core::RepoStatus;
 
-/// The status badge shown next to an issue or pull request: icon + colored square,
-/// with a tooltip describing the status.
+/// Status badge shown next to an issue or pull request.
 pub fn status_badge(status: RepoStatus, cx: &App) -> AnyElement {
     let (icon, label, tooltip, bg, fg) = match status {
         RepoStatus::Open => (
-            CustomIconName::GitIssueDone,
+            CustomIconName::GitIssueOpen,
             "open",
             "Issue is open",
-            cx.theme().primary,
-            cx.theme().primary_foreground,
+            cx.theme().secondary,
+            cx.theme().secondary_foreground,
         ),
         RepoStatus::Closed => (
             CustomIconName::GitIssueClosed,
@@ -31,11 +30,11 @@ pub fn status_badge(status: RepoStatus, cx: &App) -> AnyElement {
             cx.theme().accent_foreground,
         ),
         RepoStatus::Applied => (
-            CustomIconName::GitIssueOpen,
+            CustomIconName::GitIssueDone,
             "applied",
             "Issue is completed",
-            cx.theme().secondary,
-            cx.theme().secondary_foreground,
+            cx.theme().primary,
+            cx.theme().primary_foreground,
         ),
     };
 

crates/signed_ui/src/title_bar.rs

@@ -8,12 +8,7 @@ struct WindowDragState {
     should_move: bool,
 }
 
-/// Make an element behave like a window title bar: dragging it moves the
-/// window, and double-clicking zooms the window (or performs the platform's
-/// default title-bar double-click action on macOS).
-///
-/// Only the bar's non-interactive areas should get this — tabs are draggable
-/// (to reorder panels) and must not move the window.
+/// Make an element behave like a window title bar.
 pub fn title_bar_drag_handlers(
     this: Stateful<Div>,
     window: &mut Window,

crates/signed_ui/src/tree_row.rs

@@ -4,8 +4,6 @@ use gpui_component::list::ListItem;
 use gpui_component::tree::TreeEntry;
 use gpui_component::{Icon, IconName, Sizable, h_flex};
 
-/// One row of a file tree: icon + name, indented by depth.
-/// Clicking a file runs `on_click`; folders expand/collapse via the tree itself.
 pub fn tree_row<F>(ix: usize, entry: &TreeEntry, selected: bool, on_click: F) -> ListItem
 where
     F: Fn(&mut Window, &mut App) + 'static,
@@ -34,7 +32,6 @@ where
                 .child(div().text_sm().text_ellipsis().child(item.label.clone())),
         )
         .on_click(move |_event, window, cx| {
-            // Folders expand/collapse via the tree itself.
             if is_folder {
                 return;
             }

crates/signed_ui/src/user_avatar.rs

@@ -1,48 +0,0 @@
-use gpui::prelude::*;
-use gpui::{App, SharedString, StyleRefinement, Window};
-use gpui_component::avatar::Avatar;
-use gpui_component::{ActiveTheme, Sizable, StyledExt};
-
-/// A user avatar: the gpui-component [`Avatar`] sized small and rounded with
-/// the theme radius, showing the user's picture or a name-initials fallback.
-#[derive(IntoElement)]
-pub struct UserAvatar {
-    name: SharedString,
-    picture: Option<SharedString>,
-    style: StyleRefinement,
-}
-
-impl UserAvatar {
-    /// Create an avatar for `name`; the name seeds the initials fallback
-    /// shown when no picture is set.
-    pub fn new(name: impl Into<SharedString>) -> Self {
-        Self {
-            name: name.into(),
-            picture: None,
-            style: StyleRefinement::default(),
-        }
-    }
-
-    /// The user's picture URL, if known.
-    pub fn picture(mut self, picture: Option<impl Into<SharedString>>) -> Self {
-        self.picture = picture.map(Into::into);
-        self
-    }
-}
-
-impl Styled for UserAvatar {
-    fn style(&mut self) -> &mut StyleRefinement {
-        &mut self.style
-    }
-}
-
-impl RenderOnce for UserAvatar {
-    fn render(self, _window: &mut Window, cx: &mut App) -> impl IntoElement {
-        Avatar::new()
-            .name(self.name)
-            .when_some(self.picture, |this, url| this.src(url))
-            .rounded(cx.theme().radius)
-            .refine_style(&self.style)
-            .small()
-    }
-}

crates/signed_ui/src/util.rs

@@ -1,38 +0,0 @@
-/// `[head chars]...[tail chars]` middle truncation; the value is left alone
-/// when it is too short for the ellipsis to save space.
-pub fn middle_truncate(value: &str, head: usize, tail: usize) -> String {
-    let len = value.chars().count();
-    if len <= head + tail + 3 {
-        return value.to_string();
-    }
-    let head: String = value.chars().take(head).collect();
-    let tail: String = value.chars().skip(len - tail).collect();
-    format!("{head}...{tail}")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn middle_truncates_long_values_only() {
-        assert_eq!(
-            middle_truncate(
-                "a008def15796fba9a0d6fab04e8fd57089285d9fd505da5a83fe8aad57a3564d",
-                10,
-                10,
-            ),
-            "a008def157...ad57a3564d"
-        );
-        assert_eq!(
-            middle_truncate(
-                "30617:a008def15796fba9a0d6fab04e8fd57089285d9fd505da5a83fe8aad57a3564d:ngit",
-                10,
-                10
-            ),
-            "30617:a008...3564d:ngit"
-        );
-        // Too short to save space with the ellipsis: left alone.
-        assert_eq!(middle_truncate("short", 10, 10), "short");
-    }
-}

crates/utils/src/lib.rs

@@ -1,5 +1,9 @@
 mod pubkey;
+mod repo_url;
+mod text;
 mod time;
 
 pub use pubkey::shorten_pubkey;
-pub use time::{relative_time, relative_time_secs};
+pub use repo_url::same_repo_url;
+pub use text::{flatten_whitespace, middle_truncate};
+pub use time::{latest, relative_time, relative_time_secs, sort_newest_first};

crates/utils/src/pubkey.rs

@@ -1,7 +1,14 @@
 use nostr::prelude::*;
 
-/// Shorten a [`PublicKey`] to `npub1abc...wxyz` form.
-pub fn shorten_pubkey(public_key: PublicKey, len: usize) -> String {
-    let npub = public_key.to_bech32().unwrap();
-    format!("{}...{}", &npub[..(len + 5)], &npub[npub.len() - len..])
+use crate::text::middle_truncate;
+
+const HEAD_CHARS: usize = 9;
+const TAIL_CHARS: usize = 4;
+
+pub fn shorten_pubkey(public_key: PublicKey) -> String {
+    let encoded = public_key
+        .to_bech32()
+        .unwrap_or_else(|_| public_key.to_hex());
+
+    middle_truncate(&encoded, HEAD_CHARS, TAIL_CHARS)
 }